CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The libtiff library version 4.0.6 has an out-of-bounds read in the readContigTilesIntoBuffer() function.
In libtiff version 4.0.6, there is a vulnerability related to a buffer overflow in the readContigStripsIntoBuffer() function, leading to reading an undefined buffer.
The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in the tiffcrop.c tool. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.
The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in the t2p_process_jpeg_strip() function.
Pliki tif_predict.h i tif_predict.c w libtiff 4.0.6 zawierają asercje, które mogą prowadzić do awarii asercji w trybie debugowania lub przepełnienia bufora w trybie produkcyjnym, gdy przetwarzane są nietypowe rozmiary kafelków, takie jak YCbCr z subsamplingiem.
The libtiff library version 4.0.6 has an issue in the error code path of the TIFFFlushData1() function that does not reset the tif_rawcc and tif_rawcp members. This leads to a heap buffer overflow.
In libtiff version 4.0.6, there are out-of-bounds write vulnerabilities in heap allocated buffers related to tif_pixarlog.c. This issue was reported as MSVR 35094, also known as 'PixarLog horizontalDifference heap-buffer-overflow.'
Certain SIEMENS branded IP camera models may allow an attacker with network access to obtain administrative credentials. This affects models prior to specific software versions.
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before version 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code.
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.
In Exponent CMS 2.4.0 patch1, untrusted input is passed into the getSearchResults method in notfoundController.php. This method uses the '$term' parameter directly in SQL, leading to a SQL injection vulnerability.
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
In Exponent CMS v2.4.0 and older, the 'target' parameter of the 'DragnDropReRank' function is used without filtration, leading to SQL injection vulnerability.
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
The perl script /opt/teradata/gsctools/bin/t2a.pl in Teradata Virtual Machine Community Edition v15.10 creates files in /tmp in an insecure manner, which may lead to elevated code execution.
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
A stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be exploited by local attackers or attackers able to inject arguments to these binaries to execute code.
A vulnerability in the web-based graphical user interface of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
A vulnerability in the SDP parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This affects versions prior to 2.0.3 and Acano Server versions 1.9.x prior to 1.9.5 and 1.8.x prior to 1.8.17.