CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The FileReader class in Mozilla Firefox before version 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation.
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element.
An integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by mishandling end tags.
The ServiceWorkerManager class in Mozilla Firefox before version 45.0 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified use of the Clients API.
The nsCSPContext::SendReports function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 does not prevent the use of a non-HTTP report-uri for Content Security Policy (CSP) violation reports. This allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 45.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
A heap-based buffer overflow in Mozilla Network Security Services (NSS) before version 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
The BnGraphicBufferProducer::onTransact function in mediaserver in Android before version 4.4.4, 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism.
The BnGraphicBufferConsumer::onTransact function in mediaserver in Android 5.x before version 5.1.1 LMY49H and 6.x before March 1, 2016, does not initialize a certain slot variable. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism by triggering an ATTACH_BUFFER action.
Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before March 1, 2016 allow attackers to gain privileges via a crafted application.
The libcameraservice in mediaserver in Android versions before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require the use of the ICameraService::dump method for a camera service dump. This allows attackers to gain privileges via a crafted application, potentially obtaining Signature or SignatureOrSystem access.
The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access.
The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application.
The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application.
Przepełnienie całkowitej liczby w Adobe Flash Player przed wersją 18.0.0.333 oraz 19.x do 21.x przed wersją 21.0.0.182 na systemach Windows i OS X oraz przed wersją 11.2.202.577 na Linuxie, a także w Adobe AIR przed wersją 21.0.0.176, Adobe AIR SDK przed wersją 21.0.0.176 i Adobe AIR SDK & Compiler przed wersją 21.0.0.176, umożliwia atakującym wykonanie dowolnego kodu poprzez nieokreślone wektory. Jest to inna podatność niż CVE-2016-0963 i CVE-2016-0993.
Adobe Flash Player versions before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as Adobe AIR versions before 21.0.0.176, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as Adobe AIR versions before 21.0.0.176, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as in Adobe AIR before 21.0.0.176, allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X, as well as before 11.2.202.577 on Linux. A similar vulnerability exists in Adobe AIR and its SDK before version 21.0.0.176.