CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.
The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.
The coff_slurp_line_table function in the Binary File Descriptor (BFD) library in version 2.29.1 of GNU Binutils allows remote attackers to cause a denial of service through a crafted PE file, leading to invalid memory access and application crash.
ASP.NET Core versions 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application.
Microsoft Excel 2016 Click-to-Run (C2R) contains a vulnerability that allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory.
.NET Core versions 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests.
Podatność w Microsoft Office 2007, 2010, 2013 i 2016 pozwala atakującemu na wykonanie dowolnego kodu w kontekście bieżącego użytkownika z powodu niewłaściwego zarządzania obiektami w pamięci. Jest to znane jako 'Podatność na uszkodzenie pamięci w Microsoft Office'.
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
A vulnerability in Microsoft Excel allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory.
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read. The attacker can also act on behalf of the victim, changing permissions and deleting content.
ChakraCore and Microsoft Edge in Windows 10 and Windows Server allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
Internet Explorer in Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10, and Windows Server 2016 allows an attacker to gain the same user rights as the current user due to how Microsoft browsers handle objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
ChakraCore and Microsoft Edge in Windows 10 and Windows Server have a vulnerability that allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory by the scripting engine.
ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
A vulnerability in the Microsoft Edge scripting engine in Windows 10 and Windows Server allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory.
A vulnerability in ChakraCore and Internet Explorer across various versions of Windows allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory by Microsoft browsers.
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 (all versions up to 1709) and Windows Server 2016 allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory.
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and version 1709 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS