CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
An issue was discovered in the node-serialize package 0.0.4 for Node.js that allows arbitrary code execution. Untrusted data passed into the unserialize() function can be exploited by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
The Packages.php file in Simple Machines Forum (SMF) 2.1 contains a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
A heap-based buffer overflow was found in the DHCP client (udhcpc) in BusyBox before version 1.25.0. Remote attackers may exploit this vulnerability through unspecified vectors involving OPTION_6RD parsing.
A heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
A heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
A heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
In NetCommWireless HSPA 3G10WVE wireless routers with firmware before version 3G10WVE-L101-S306ETS-C01_R05, the ping.cgi script allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.
The IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network to change a user's password and gain remote access to the system.
IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database.
EMC Isilon InsightIQ versions 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 are affected by an authentication bypass vulnerability that could potentially be exploited by attackers to compromise the affected system.
CVE-2016-8418 identifies a remote code execution vulnerability in the Qualcomm crypto driver that could allow a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the kernel context.
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
NetApp OnCommand Unified Manager for Clustered Data ONTAP versions 6.3 through 6.4P1 contain a default privileged account, allowing remote attackers to execute arbitrary code via unspecified vectors.
NetApp Virtual Storage Console for VMware vSphere before version 6.2.1 uses a non-unique certificate, allowing remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Multiple SQL injection vulnerabilities in Exponent CMS before version 2.4.0 allow remote attackers to execute arbitrary SQL commands through various parameters such as id, title, and content_id.
The ObjectSocketWrapper.java in Gradle 2.12 has a vulnerability that allows remote attackers to execute arbitrary code via a crafted serialized object.
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.