CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Microsoft Office 2007, 2010, 2013, and 2016, as well as Skype for Business and Lync 2013 SP1, have a vulnerability that allows remote attackers to bypass a sandbox protection mechanism. Attackers can gain elevated privileges by visiting a crafted website in Internet Explorer.
A vulnerability in Microsoft Windows allows local users to gain elevated privileges via a crafted application that triggers a Winsock call referencing an invalid address.
Microsoft Internet Explorer 9 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The vulnerability in the PDF viewer in Google Chrome before version 46.0.2490.86 allows remote attackers to bypass the Same Origin Policy via unintended embedder or unintended plugin loading.
The SQL interface in SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via unspecified vectors related to 'SQL Login'.
The Extended Application Services (XS) in SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via unspecified vectors related to 'HTTP Login'.
SAP HANA Database 1.00 SPS10 and earlier do not require authentication, allowing remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet.
Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to 'phase one 0x412 tag,' which triggers a heap-based buffer overflow.
A .desktop file in the Debian openjdk-7 package version 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, allowing remote attackers to execute arbitrary code via a JAR file.
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
In the MIT Kerberos 5 library before version 1.14, there is an issue with an inappropriate context handle in the iakerb.c file. This allows remote attackers to cause a denial of service by sending a crafted IAKERB packet that is mishandled during a gss_inquire_context call.
IBM Security Guardium versions 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 contain a vulnerability that allows local users to gain root access via unspecified key sequences.
CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an 'su root' action by leveraging presence on the cluster-wide password-change list.
IBM Security Access Manager for Web versions 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandle WebSEAL HTTPTransformation requests, allowing remote attackers to read or write to arbitrary files.
Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which makes it easier for remote attackers to obtain access via an SSH session.
The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_logout function, allowing remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module.
The hw/ide/core.c file in QEMU does not properly restrict the commands accepted by an ATAPI device, allowing guest users to cause a denial of service or potentially other unspecified impacts via certain IDE commands.
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before version 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
The datastor kernel module in F5 BIG-IP allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
The admin web interface in Cisco AsyncOS 8.x before version 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments.