CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Creolabs Gravity version 1.0, a Use-After-Free vulnerability exists that may lead to code execution. The issue involves the 'sublexer' pointer being freed and then accessed in the code, resulting in unsafe memory access.
October CMS version 412 is vulnerable to file path modification in asset move functionality, potentially allowing the creation of malicious files on the server.
October CMS version 412 is vulnerable to PHP code execution in the asset manager functionality, potentially leading to site compromise and possibly affecting other applications on the server.
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality, potentially leading to site compromise and affecting other applications on the server.
The soyuka/pidusage module in versions <= 1.1.4 is vulnerable to command injection, allowing arbitrary command execution.
picoTCP versions 1.7.0 to 1.5.0 are vulnerable to stack buffer overflow, which may lead to code execution or denial of service attacks.
All versions of windows-cpu by KyleRoss are vulnerable to command injection, which can lead to code execution as the Node.js user.
LightFTP version 1.1 is vulnerable to a buffer overflow in the 'writelogentry' function resulting in denial of service or remote code execution.
CVE-2017-0854 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of Android.
CVE-2017-0853 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of Android.
CVE-2017-0847 is a privilege escalation vulnerability in the Android media framework (mediaanalytics). It affects version 8.0 of Android.
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the widgetid parameter in /MyPage.do.
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in the getResourceProfiles action.
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the forpage parameter in the /MyPage.do?method=viewDashBoard request.
Zoho ManageEngine Applications Manager 13 is vulnerable to SQL injection via the groupname parameter in /manageConfMons.do.
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in a showPlasmaView action.
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the haid parameter in the /manageApplications.do?method=AddSubGroup request.
A heap-based buffer overflow in the loadbuf function in formisc.c in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message.
Privilege escalation vulnerability in the admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18, and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS