CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The arcmsr_iop_message_xfer function in the Linux kernel up to version 4.8.2 does not restrict a certain length field, allowing local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers.
CVE-2016-0249 describes an SQL injection vulnerability in IBM Security Guardium Database Activity Monitor versions 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
In the Linux kernel before version 4.1.4, there is an issue with mishandling anonymous pages, allowing local users to gain privileges or cause a denial of service via a crafted application that triggers writing to page zero.
Kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Podatność w Microsoft Word i powiązanych produktach umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany dokument RTF. Dotyczy to wielu wersji Worda oraz usług związanych z Office na różnych platformach.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site.
The Standard Collector Service in Windows Diagnostics Hub in Microsoft Windows 10 Gold, 1511, and 1607 mishandles library loading, allowing local users to gain privileges via a crafted application.
Kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka 'Win32k Elevation of Privilege Vulnerability.'
A vulnerability in the GDI/GDI+ interface in Microsoft Windows and Office applications allows remote attackers to execute arbitrary code via a crafted embedded font.
Podatność w interfejsie GDI/GDI+ w systemach Microsoft Windows umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez specjalnie przygotowaną stronę internetową. Dotyczy to wielu wersji systemów Windows, w tym Vista, 7, 8.1, 10 oraz serwerów Windows 2008 i 2012.
The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, allowing remote attackers to gain privileges via unspecified vectors.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.