CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname.
The vulnerability in IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.
The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, allowing attackers to execute arbitrary code in a privileged context via a crafted app.
Kext tools in Apple OS X before 10.11.2 mishandle kernel-extension loading, allowing local users to gain privileges via unspecified vectors.
MobileStorageMounter in iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, allowing attackers to execute arbitrary code in a privileged context.
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, allowing attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
A stack-based buffer overflow in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 18.0.0.268 for Flash Player and before 20.0.0.204 for Adobe AIR.
Adobe Flash Player and Adobe AIR before specified versions allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion' vulnerability.
Adobe Flash Player before version 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects various software versions on Windows, OS X, and Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via a crafted filters property value in a TextField object.
A use-after-free vulnerability in the MovieClip object in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via a crafted lineTo method call.
A use-after-free vulnerability in the DisplacementMapFilter object implementation in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux. It allows attackers to execute arbitrary code via a crafted mapBitmap property value.
A use-after-free vulnerability in the Color object implementation in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux. It allows attackers to execute arbitrary code via crafted setTransform arguments.
A heap-based buffer overflow in Adobe Flash Player allows attackers to execute arbitrary code via an MP3 file with mishandled COMM tags. This affects versions before 18.0.0.268 on Windows and OS X, and before 11.2.202.554 on Linux.
Integer overflow in the Shader filter implementation in Adobe Flash Player before version 18.0.0.268 and 19.x and 20.x before version 20.0.0.228 on Windows and OS X and before version 11.2.202.554 on Linux, as well as in Adobe AIR before version 20.0.0.204, Adobe AIR SDK before version 20.0.0.204, and Adobe AIR SDK & Compiler before version 20.0.0.204, allows attackers to execute arbitrary code via a large BitmapData source object.