CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An out-of-memory flaw was found in libtiff. Passing a crafted TIFF file to the TIFFOpen() API may allow a remote attacker to cause a denial of service via crafted input smaller than 379 KB.
A vulnerability in the libtiff library related to handling the SamplesPerPixel tag allows an attacker to cause a denial of service (DoS). Package updates are available for Amazon Linux 2023 that fix this issue.
No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).
rack-proxy versions 1.0.0 through 1.0.2 can forward an incorrect Content-Length when a backend response contains both Transfer-Encoding and Content-Length headers. Net::HTTP removes chunked framing from the body, while rack-proxy strips Transfer-Encoding but retains the backend-supplied Content-Length.
A NULL pointer access occurs in the imagetopnm function of convert.c (jp2):1289 in OpenJPEG 2.1.2. Exploitation requires opening a crafted j2k file.
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash).
An integer overflow vulnerability was found in the tiftoimage function in OpenJPEG 2.1.2, resulting in a heap buffer overflow.
A vulnerability was found in the Skia component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.
A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure.
No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).
NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. Third parties dispute this because the LLVM security policy excludes language front-ends for which a malicious input file can cause undesirable behavior.
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. This may lead to application crashes.
llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). This may lead to application crashes.
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be affected.
In the cryptography package for Python before version 3.3.2, sequences of update calls for symmetric encryption of multi-GB data can cause integer overflow and buffer overflow, as demonstrated with the Fernet class.
A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.
The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.
A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.
Vulnerability in CPAN 2.28 allows signature verification bypass. An attacker can supply unauthorized code that is treated as properly signed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS