CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A double free vulnerability in Adobe Reader and Acrobat allows attackers to execute arbitrary code via a crafted Graphics State dictionary. This affects versions before 11.0.14, and DC Classic before 15.006.30119 and DC Continuous before 15.010.20056 on Windows and OS X.
CVE-2016-4349 in Cisco WebEx Productivity Tools 2.40.5001.10012 has an untrusted search path vulnerability that allows local users to gain privileges via malicious DLL files in the current working directory.
CVE-2016-1389 in Cisco WebEx Meetings Server (CWMS) 2.6 is an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
The API in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0(1) allows remote attackers to spoof administrative notifications via crafted attribute-value pairs.
The arch_pick_mmap_layout function in the Linux kernel up to version 4.5.2 does not properly randomize the legacy base address, making it easier for local users to bypass restrictions on the ADDR_NO_RANDOMIZE flag and the ASLR protection mechanism for setuid or setgid programs.
Integer overflow in the xt_alloc_table_info function in the Linux kernel up to version 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service via an IPT_SO_SET_REPLACE setsockopt call.
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, allowing local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
The fork implementation in the Linux kernel before version 4.5 on s390 platforms mishandles the case of four page-table levels, allowing local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application.
A race condition in the Linux kernel before version 4.4.1 in arch/x86/mm/tlb.c allows local users to gain privileges by triggering access to a paging structure by a different CPU.
Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Allround Automations PL/SQL Developer 11 before version 11.0.6 relies on unverified HTTP data for updates, allowing man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 use the same hardcoded encryption key across different customers' installations, allowing attackers to defeat cryptographic protection mechanisms.
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 has a vulnerability in the flu.cgi file that allows remote authenticated users to execute arbitrary commands via the 5066 (dnsmasq) parameter.
CVE-2016-1202 in Atom Electron before version 0.33.5 has an untrusted search path vulnerability that allows local users to gain privileges via a Trojan horse Node.js module in a parent directory.
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Samba versions 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 do not verify X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
The management console on Symantec Messaging Gateway (SMG) Appliance devices before version 10.6.1 allows local users to obtain root-shell access via crafted terminal-window input.