CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The NVIDIA GPU Display Driver for Quadro, NVS, GeForce, and Tesla products contains a vulnerability in the kernel mode layer that allows access to arbitrary physical memory due to a missing permissions check.
The NVIDIA Windows GPU Display Driver for R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a lack of bounds checking on user input for array indexing can lead to denial of service or potential privilege escalation.
CVE-2016-5852 vulnerability affects NVIDIA Quadro, NVS, and GeForce products, related to unquoted service paths in GFE GameStream and NVTray Plugin. Exploiting this vulnerability may allow malicious code to execute at the system/user privilege level.
The NVIDIA NVStreamKMS.sys service in NVIDIA Quadro, NVS, and GeForce products improperly validates user-supplied data through its API entry points, leading to elevation of privilege.
For NVIDIA Quadro, NVS, and GeForce products, there is a Remote Desktop denial of service vulnerability. A successful exploit will result in a kernel null pointer dereference, causing a blue screen crash.
CVE-2016-3161 concerns a vulnerability in NVIDIA Quadro, NVS, and GeForce products related to unquoted service paths in Windows. Exploiting this vulnerability may allow malicious code to execute at the system or user privilege level.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have a use-after-free vulnerability that can be exploited by an attacker. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the 'crafted image file' approach. This issue is related to an 'Insecure Sign Extension' problem affecting the ImagingNew in Storage.c component.
The 'image' module in Moodle 3.1.2 has an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
Moodle 3.1.2 has an unrestricted file upload vulnerability in the 'legacy course files' and 'file manager' modules. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.