CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Persistent Accelerite Radia Client Automation (formerly HP Client Automation) before version 9.1 allows remote attackers to execute arbitrary code by sending unspecified commands in an environment lacking relationship-based firewalling.
A stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation) may allow remote attackers to execute arbitrary code by sending a large amount of data in an environment lacking relationship-based firewalling.
The SSH server in Juniper Junos OS before versions 12.1X44-D50, 12.1X46-D35, 12.1X47-D25, 12.3R10, 12.3X48-D10, 13.2R8, 13.2X51-D35, 13.3R6, 14.1R5, 14.1X53-D25, 14.2R3, 15.1R1, and 15.1X49-D20 allows remote attackers to cause a denial of service (CPU consumption) via unspecified SSH traffic.
The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before version 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the 'host-OS.'
EMC SourceOne Email Supervisor before version 7.2 does not properly use random values for session IDs, making it easier for remote attackers to gain access by guessing an ID.
Adobe Flash Player versions before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux contains a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before version 11.2.202.535 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as in Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before version 11.2.202.535 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
OpenNMS has a default password of 'rtc' for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a 'forced API token change' involving anonymous users.
J-Web in Juniper vSRX virtual firewalls with Junos OS before version 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.
In Juniper Junos OS versions before 11.4R12-S4, 12.1X44-D41, 12.1X46-D26, 12.1X47-D11/D15, 12.2R9, 12.2X50-D70, 12.3R8, 12.3X48-D10, 12.3X50-D42, 13.1R4-S3, 13.1X49-D42, 13.1X50-D30, 13.2R6, 13.2X51-D26, 13.2X52-D15, 13.3R3-S3, 14.1R3, 14.2R1, 15.1R1, and 15.1X49-D10, when configured for IPv6, remote attackers can cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.
CVE-2015-6003 is a directory traversal vulnerability in QNAP QTS before version 4.1.4 build 0910 and 4.2.x before version 4.2.0 RC2 build 0910, when AFP is enabled. It allows remote attackers to read or write to arbitrary files by leveraging access to an OS X user or guest account.