CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before version 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
ProcessFileUpload.jsp in SolarWinds Storage Manager before version 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 are vulnerable to a denial of service attack caused by a crafted GIOP packet. This leads to out-of-bounds read and listener crash.
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
The hdbsql client version 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google V8 before version 4.6.85.23, as used in Google Chrome before version 46.0.2490.71, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Adobe Flash Player w wersjach 18.x do 18.0.0.252 oraz 19.x do 19.0.0.207 na systemach Windows i OS X oraz 11.x do 11.2.202.535 na Linuksie umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany plik SWF. Ta podatność była wykorzystywana w atakach w październiku 2015 roku.
Multiple unspecified vulnerabilities in Google Chrome before version 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The CSSFontFaceSrcValue::fetch function in the CSS implementation in Blink, used in Google Chrome before version 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL. This allows remote web servers to bypass the Same Origin Policy via a redirect.
The Image11::map function in libANGLE, used in Google Chrome before version 46.0.2490.71, mishandles mapping failures after device-lost events. This can lead to denial of service or other unspecified impacts.
A use-after-free vulnerability in the ServiceWorker implementation in Google Chrome before version 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.
The ContainerNode::parserInsertBefore function in Blink, used in Google Chrome before version 46.0.2490.71, proceeds with a DOM tree insertion in cases where a parent node no longer contains a child node. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before version 11.2.202.535 on Linux, and in Adobe AIR before version 19.0.0.213, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code via a Video object with a crafted deblocking property.
Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player and Adobe AIR in certain versions allow attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This is a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7634.
Buffer overflow in Adobe Flash Player before version 18.0.0.252 and 19.x before version 19.0.0.207 on Windows and OS X and before version 11.2.202.535 on Linux, as well as in Adobe AIR before version 19.0.0.213, allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before version 11.2.202.535 on Linux, allows attackers to execute arbitrary code via a TextLine object with a crafted validity property.
Adobe Flash Player versions before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, as well as Adobe AIR and its SDK versions before 19.0.0.213, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.