CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
A memory corruption issue in Apple iOS and macOS due to insufficient input validation. It is fixed in iOS 12.1.4 and macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
A vulnerability in SonicWall SMA100 allows an unauthenticated user to gain read-only access to unauthorized resources. This affects SMA100 version 9.0.0.3 and earlier.
W serii PLC CJ oraz CS firmy Omron, we wszystkich wersjach, atakujący może monitorować ruch między PLC a kontrolerem oraz powtarzać żądania, co może prowadzić do otwierania i zamykania zaworów przemysłowych.
W libsixel w wersji 1.8.2 odkryto problem związany z nadmiernym odczytem bufora w stercie w funkcji load_sixel w pliku loader.c.
Wersja 2.23 biblioteki stb_image.h, używana w libsixel i innych produktach, zawiera błąd przepełnienia bufora w pamięci sterty w funkcji stbi__load_main. Może to prowadzić do nieautoryzowanego odczytu danych z pamięci.
A vulnerability in Windows when the Win32k component fails to properly handle objects in memory allows elevation of privilege.
W rhn-proxy znaleziono lukę, która może pozwolić na przesyłanie danych uwierzytelniających użytkowników w postaci niezaszyfrowanej podczas dostępu do RHN Satellite. Może to prowadzić do ujawnienia informacji, w tym wrażliwych danych uwierzytelniających.
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload.
Use after free in PDFium in Google Chrome prior to version 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340, Premium, Quantum) that could lead to the disclosure of hardcoded FTP credentials when using the controller's web server on an unsecure network.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. It could allow an attacker to execute arbitrary code in the context of the user.
Elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service due to improper allowance of COM object creation.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'. It could allow an attacker to gain higher privileges.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. An authenticated attacker would need to run a specially crafted application to elevate privileges.
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS