CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to easily crash the system, potentially leading to a DoS attack or gaining privileges.
An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.
MagpieRSS, used in the front-end component in Nagios Core before version 4.2.2, may allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server.
Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe DNG Converter versions 9.7 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.
CVE-2016-1000156 is a vulnerability related to an incomplete fix for remote file upload in Mailcwp version 1.100. It allows attackers to upload malicious files to the server.
Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
Multiple integer overflows in X.org libXtst before version 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
The XRenderQueryFilters function in X.org libXrender before version 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Multiple buffer overflows in the XvQueryAdaptors and XvQueryEncodings functions in X.org libXrender before version 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
The libXrandr library in versions before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by mishandling reply data.
Multiple integer overflows in X.org libXrandr before version 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.
Integer overflow in X.org libXfixes before version 5.0.3 on 32-bit platforms may allow remote X servers to gain privileges via a length value of INT_MAX, causing the client to stop reading data and get out of sync.
The XListFonts function in X.org libX11 before version 1.6.4 may allow remote X servers to gain privileges via vectors involving length fields, leading to out-of-bounds write operations.
The XGetImage function in X.org libX11 before version 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, leading to out-of-bounds read operations.
The XvQueryAdaptors and XvQueryEncodings functions in libXv before version 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication, consequently reading arbitrary files or possibly having unspecified other impact by leveraging a 'logic flaw' in the authentication process.
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.