CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JScript 5.8 and VBScript 5.7 and 5.8 engines in Internet Explorer 9 through 11 and other Microsoft products allow remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
The JScript 5.8 and VBScript 5.7 and 5.8 engines in Internet Explorer 9 through 11 and other Microsoft products allow remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
A vulnerability in Microsoft Windows 8.1, Windows Server 2012, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF document.
The Chakra, JScript, and VBScript engines in Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-0199 and CVE-2016-3211.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-0200 and CVE-2016-3211.
A vulnerability in Microsoft Word and other Office products allows remote attackers to execute arbitrary code via a crafted Office document. This affects multiple versions of Word and Office-related services across various platforms.
Huawei Honor WS851 routers with software version 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors.
Huawei Honor WS851 routers with software version 1.1.21.1 and earlier allow remote attackers to modify configuration data through a file injection vulnerability.
The esp_reg_read and esp_reg_write functions in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via manipulation of the information transfer buffer.
Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the 'returned length of the object from _ksba_ber_parse_tl.'
Off-by-one error in the append_utf8_value function in the DN decoder in Libksba before version 1.3.4 allows remote attackers to cause a denial of service via invalid utf-8 encoded data.
Buffer overflow in the xmlrpc_char_encode function in Atheme before version 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
The onReadyRead function in core/coreauthhandler.cpp in Quassel before version 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
The append_utf8_value function in the DN decoder in Libksba before version 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data.
Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.
The ber-decoder.c file in Libksba before version 1.3.3 uses an incorrect integer data type, allowing remote attackers to cause a denial of service (crash) via crafted BER data, leading to a buffer overflow.
The ber-decoder.c file in Libksba before version 1.3.3 has a flaw in handling decoder stack overflows, allowing remote attackers to cause a denial of service (abort) via crafted BER data.
libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, allowing remote attackers to conduct man-in-the-middle attacks or cause denial of service by advertising a node as a router from a non-local network.