CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.
The DecodePSDPixels function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.
The ReadPSDLayers function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to 'throwing of exceptions.'
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
The user-account creation feature in Chef Manage versions 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This issue is fixed in version 2.4.5.
Podatność w protokole zarządzania klastrem Cisco (CMP) w oprogramowaniu Cisco IOS i Cisco IOS XE może umożliwić nieautoryzowanemu, zdalnemu atakującemu spowodowanie ponownego uruchomienia urządzenia lub zdalne wykonanie kodu z podwyższonymi uprawnieniami. Problem wynika z niewłaściwego przetwarzania opcji Telnet specyficznych dla CMP oraz braku ograniczeń w ich użyciu tylko do lokalnych komunikacji między członkami klastra.
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.
The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.
Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, allowing attackers to execute arbitrary code on a target OS.
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
A stack-based buffer overflow vulnerability has been identified in the Fatek Automation PLC Ethernet Module, which may allow remote code execution or crash the affected device. This affects the Ether_cfg software configuration tool running on specific Fatek PLC versions.
A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
The gnuplot delegate functionality in ImageMagick before version 6.9.4-0 and in GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1 and USM before 5.3.1 allows remote attackers to bypass authentication, consequently obtaining sensitive information, modifying the application, or executing arbitrary code as root via an 'AV Report Scheduler' HTTP User-Agent header.
Sawmill Enterprise version 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.