CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document.
Microsoft Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document.
Podatność w programach Microsoft Excel i Excel Viewer umożliwia zdalnym atakującym, przy wsparciu użytkownika, wykonanie dowolnych poleceń poprzez specjalnie przygotowaną komórkę, która jest niewłaściwie obsługiwana po kliknięciu. Jest to znana jako 'Podatność omijania zabezpieczeń Microsoft Office'.
Kernel-mode drivers in Microsoft Windows allow local users to gain elevated privileges via a crafted application. This affects multiple versions of Windows, including Vista, 7, 8.1, 10, and Windows Server.
The Graphics Component in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges via a crafted application.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Microsoft Edge Memory Corruption Vulnerability.'
Webdynpro in SAP Solman versions 7.1 to 7.31 allows remote attackers to obtain sensitive information via specific requests.
Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had a flaw that incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(). This allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; and 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot. This allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
A heap use after free in PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.
An issue was discovered in Apport before version 2.20.4 related to path traversal in the 'Package' and 'SourcePackage' fields of the crash file. An attacker can exploit this vulnerability to execute arbitrary Python files from the local system.
An issue was discovered in Apport before 2.20.4, where the CrashDB field is read and evaluated as Python code if it begins with '{'. This allows remote attackers to execute arbitrary Python code.
A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300 oraz S7-400, która może być wywołana przez specjalnie skonstruowane pakiety wysyłane na port 80/tcp. Tego typu pakiety mogą spowodować przejście urządzeń w tryb awarii, co wymaga zimnego restartu w celu przywrócenia systemu.
CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST allows an attacker to change the Wi-Fi password, open the remote management interface, or reset the router.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an input buffer is not validated. This can lead to denial of service or potential escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape that allows improper access controls.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated. This can lead to denial of service or possible escalation of privileges.
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) that allows a value passed from a user to be used as an index to an internal array without validation. This can lead to denial of service or potential escalation of privileges.