CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand. This may lead to application crashes.
A vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Affected versions are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. An easily exploitable vulnerability allows a low privileged attacker with network access via multiple protocols to compromise MySQL.
A vulnerability was found in the Skia component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.
Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.
NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. Third parties dispute this because the LLVM security policy excludes language front-ends for which a malicious input file can cause undesirable behavior.
A flaw was found in the xdg-email component of xdg-utils 1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when passed to Thunderbird, potentially automatically attaching a victim's sensitive file.
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. This may lead to application crashes.
llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). This may lead to application crashes.
A vulnerability was found in LibTIFF up to 4.7.0. The function t2p_read_tiff_init of the file tools/tiff2pdf.c of the fax2ps component is affected. The manipulation leads to a null pointer dereference, and the attack requires local access.
llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.". This may lead to application crashes.
A vulnerability in the libtiff library related to handling the SamplesPerPixel tag allows an attacker to cause a denial of service (DoS). Package updates are available for Amazon Linux 2023 that fix this issue.
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash).
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr). This may lead to application crashes.
A NULL pointer access occurs in the imagetopnm function of convert.c (jp2):1289 in OpenJPEG 2.1.2. Exploitation requires opening a crafted j2k file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS