CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. Similar issues exist in Adobe AIR and its SDK before version 20.0.0.233, allowing attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux, allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. It also affects Adobe AIR before 20.0.0.233 and Adobe AIR SDK and Compiler before 20.0.0.233, allowing attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. Similar issues exist in Adobe AIR and its SDK before version 20.0.0.233, allowing attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. It also affects Adobe AIR before 20.0.0.233 and Adobe AIR SDK before 20.0.0.233, allowing attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. This vulnerability allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, as well as Adobe AIR and its SDK versions before 20.0.0.233, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. It also affects Adobe AIR before 20.0.0.233 and Adobe AIR SDK and Compiler before 20.0.0.233, allowing attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.324 and in versions 19.x and 20.x before 20.0.0.267 on Windows and OS X, as well as before 11.2.202.559 on Linux. A similar vulnerability exists in Adobe AIR and its SDK before version 20.0.0.233, allowing attackers to execute arbitrary code.
Adobe Flash Player versions before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.233, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, allowing local users to gain privileges by leveraging a login session.
The networking implementation in the Linux kernel through version 4.3.3, used in Android and other products, does not validate protocol identifiers for certain protocol families. This can lead to denial of service or potential privilege escalation by local users.
NETGEAR WNR1000v3 devices with firmware 1.0.2.68 use the same source port number for every DNS query, making it easier for remote attackers to spoof responses by selecting that number for the destination port.
Integer overflow in the WebCursor::Deserialize function in Google Chrome before version 47.0.2526.106 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via a crafted RGBA pixel array.
The ff_get_buffer function in libavcodec/utils.c in FFmpeg before version 2.8.4 preserves width and height values after a failure, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.
The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before version 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which may lead to denial of service or other unspecified impacts.
The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before version 2.8.3 does not validate the relationship between the number of threads and the number of slices, which may lead to denial of service (out-of-bounds array access) or potentially other unspecified impacts via crafted H.264 data.
The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Adcon Telemetry A840 Telemetry Gateway allows remote attackers to obtain sensitive information by sniffing the network.