CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Web Viewer version 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
Web Viewer version 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
Cisco Aironet 1800 devices with software versions 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to gain access via unspecified vectors.
The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet.
The CSRF vulnerability in IBM WebSphere Commerce allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. It affects versions 6.0 through 6.0.0.11 and 7.0 through 7.0.0.9 and 7.0 Feature Pack 8.
SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
The CSRF vulnerability in Advantech WebAccess before version 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Funkcje roaming_read i roaming_write w OpenSSH w wersjach 5.x, 6.x i 7.x przed 7.1p2 nie utrzymują prawidłowo deskryptorów plików połączeń, gdy włączone są określone opcje proxy i forward. To może prowadzić do odmowy usługi (przepełnienie bufora na stercie) lub innych nieokreślonych skutków przez żądanie wielu przekierowań.
There is an untrusted search path vulnerability in Adobe Download Manager that allows local users to gain privileges via a crafted resource in an unspecified directory. This affects Adobe Reader and Acrobat versions before 11.0.14, and Acrobat and Acrobat Reader DC Classic before 15.006.30119 and DC Continuous before 15.010.20056 on Windows and OS X.
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X mishandle the Global object, allowing attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14, and Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code.
Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service via unspecified vectors. This is a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
The AcroForm plugin in Adobe Reader and Acrobat before 11.0.14, and Acrobat and Acrobat Reader DC Classic before 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A use-after-free vulnerability in the OCG object implementation in Adobe Reader and Acrobat before 11.0.14, and in Acrobat and Acrobat Reader DC Classic before 15.006.30119, as well as in Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allows attackers to execute arbitrary code.
Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG 2000 data.
A double free vulnerability in Adobe Reader and Acrobat before version 11.0.14, and in Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as in Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allows attackers to execute arbitrary code via a crafted ExtGState dictionary.
A use-after-free vulnerability in AGM.dll in Adobe Reader and Acrobat before version 11.0.14, and in Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as in Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allows attackers to execute arbitrary code via a multiple-layer PDF document.
Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14, and in Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X.