CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Atakujący z sieci, nieposiadający uprawnień, może uzyskać uprawnienia systemowe do skonfigurowanych SKU zarządzania Intela, takich jak Intel Active Management Technology (AMT) oraz Intel Standard Manageability (ISM). Ponadto, lokalny atakujący bez uprawnień może skonfigurować funkcje zarządzania, uzyskując nieuprawnione uprawnienia sieciowe lub lokalne na SKU zarządzania Intela.
The Cloud Controller in Cloud Foundry before version 239 logs user-provided service objects at creation, allowing attackers to obtain sensitive user credential information via unspecified vectors.
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'
The vulnerability in lxc-attach in LXC before version 1.0.9 and 2.x before version 2.0.6 allows an attacker inside an unprivileged container to use an inherited file descriptor from the host's /proc to access the rest of the host's filesystem via the openat() family of syscalls.
Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
The mDNS responder in BOSE Soundtouch 30 incorrectly responds to IPv4 unicast queries with non-link-local source addresses. This can lead to denial of service or exposure of potentially sensitive information.
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, allowing remote attackers to cause a denial of service (traffic amplification) and may lead to information leakage.
The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function.
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
Buffer overflow in Quest One Identity Privilege Manager for Unix before version 6.0.0.061 allows remote attackers to gain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.
The GlobalProtect external interface in PAN-OS before version 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.
Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests.
UDFclient (before version 0.8.8) has a custom strlcpy implementation that is vulnerable to buffer overflow. This issue occurs on systems with a C library that lacks its own strlcpy.
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled.
A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole 'Simple PHP File Manager' component).