CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Tollgrade SmartGrid LightHouse Sensor Management System (SMS) software versions before 5.1 and 4.1.0 Build 16 allow remote authenticated users to change arbitrary passwords via unspecified vectors.
A Cross-site request forgery (CSRF) vulnerability in the Tollgrade SmartGrid LightHouse Sensor Management System allows remote attackers to hijack the authentication of arbitrary users.
The kadm5_create_principal_3 and kadm5_modify_principal functions in kadmind in MIT Kerberos 5 before version 1.13.4 and 1.14.1 allow remote authenticated users to cause a denial of service by specifying KADM5_POLICY with a NULL policy name.
In libavcodec/gif.c in FFmpeg before version 2.8.6, the buffer size is not properly calculated, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file.
In libavcodec/tiff.c in FFmpeg before version 2.8.6, RowsPerStrip values and YCbCr chrominance subsampling factors are not properly validated. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file.
In the libswscale library in FFmpeg before version 2.8.6, certain height values are not validated, allowing remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file.
The libavcodec/pngenc.c in FFmpeg before version 2.8.5 has a flaw in line size calculations, which may lead to out-of-bounds array access. Remote attackers can exploit this vulnerability by sending a crafted .avi file.
Integer overflow in the asf_write_packet function in FFmpeg before version 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS value in a .mov file.
The REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access restrictions and create arbitrary user accounts via unspecified web requests.
The proxy engine in Cisco Advanced Malware Protection (AMP) allows remote attackers to bypass intended content restrictions via a malformed e-mail message containing an encoded file.
Adobe Flash Player and Adobe AIR prior to specified versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Podatność typu use-after-free w Adobe Flash Player przed wersją 18.0.0.329 oraz w wersjach 19.x i 20.x przed 20.0.0.306 na systemach Windows i OS X, a także przed 11.2.202.569 na systemie Linux. Dotyczy również Adobe AIR przed wersją 20.0.0.260 oraz Adobe AIR SDK i Compiler przed tą samą wersją, co pozwala atakującym na wykonanie dowolnego kodu.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.329 and in versions 19.x and 20.x before 20.0.0.306 on Windows and OS X, as well as before 11.2.202.569 on Linux. It also affects Adobe AIR before version 20.0.0.260 and Adobe AIR SDK and Compiler before version 20.0.0.260, allowing attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.329 and in versions 19.x and 20.x before 20.0.0.306 on Windows and OS X, as well as before 11.2.202.569 on Linux. Also affects Adobe AIR before version 20.0.0.260 and Adobe AIR SDK and Compiler before version 20.0.0.260.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, as well as Adobe AIR and its SDK before 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X, as well as before 11.2.202.569 on Linux, and Adobe AIR and its SDK before 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.260, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.