CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
In WebKit in Blink, used in Google Chrome before version 49.0.2623.75, there is an issue with improperly determining when anonymous block wrappers may exist. This could allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JavaScript code.
A use-after-free vulnerability in Google Chrome before version 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted.
A use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in Blink, used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website.
The Extensions subsystem in Google Chrome before version 49.0.2623.75 does not properly maintain its own properties, allowing remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast.
The PPB_Flash_MessageLoop_Impl::InternalRun function in the Pepper plugin in Google Chrome before version 49.0.2623.75 mishandles nested message loops, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
The ContainerNode::parserRemoveChild function in Blink, used in Google Chrome before version 49.0.2623.75, mishandles widget updates, making it easier for remote attackers to bypass the Same Origin Policy via a crafted website.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player and Adobe AIR before specified versions allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data. This issue affects various software versions on Windows, OS X, and Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through crafted MPEG-4 data. This issue affects various software versions on Windows, OS X, and Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.
Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file.
CSRF vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.