CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in GDI of Microsoft Windows allows remote attackers to execute arbitrary code via a crafted document. This affects multiple versions of Windows, including Vista, 7, 8.1, 10, and Server 2008 and 2012.
Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading, allowing local users to gain privileges via a crafted application.
Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 have a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
In Squid 3.x before version 3.5.18 and 4.x before version 4.0.10, a vulnerability allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.
The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.
The convert extension in Mercurial before version 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
wpa_supplicant versions 0.4.0 through 2.5 do not reject and characters in passphrase parameters, allowing local users to trigger arbitrary library loading and consequently gain privileges or cause a denial of service (daemon outage) via a crafted SET, SET_CRED, or SET_NETWORK command.
Versions of hostapd from 0.6.7 to 2.5 and wpa_supplicant from 0.6.7 to 2.5 do not reject and characters in passphrase parameters, allowing remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, allowing attackers to spoof message authentication.
OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication.
The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application.
The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application.
In libstagefright in mediaserver in Android, there is a vulnerability that does not validate buffer sizes in SoftAMR.cpp. This allows attackers to gain privileges via a crafted application.
In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.
In libstagefright in mediaserver in Android, there is a vulnerability that does not validate OMX buffer sizes. This allows attackers to gain privileges via a crafted application.
The Camera3Device.cpp file in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, does not validate template IDs. This allows attackers to gain privileges via a crafted application.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01, there is a vulnerability in NuPlayerStreamListener.cpp that does not properly validate entry data structures. This allows attackers to gain privileges via a crafted application.