CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.
Multiple integer overflows in libstagefright in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
A use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before version 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
The mozilla::AudioSink function in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 mishandles inconsistent sample formats within MP3 audio data, allowing remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 40.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during optimization, allowing remote attackers to execute arbitrary code via a crafted .NET application.
The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during optimization attempts, allowing remote attackers to execute arbitrary code via a crafted .NET application.
The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an optimization attempt, allowing remote attackers to execute arbitrary code via a crafted .NET application.
A vulnerability in Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document.
The vulnerability in Microsoft Windows Vista SP2 and Server 2008 SP2 allows remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging action.
CVE-2015-2473 involves an untrusted search path vulnerability in the RDP client in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1. This allows local users to gain privileges via a Trojan horse DLL in the current working directory.
An integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document.
The vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allows remote attackers to execute arbitrary code via a crafted document.
A vulnerability in Microsoft Word and other Office products allows remote attackers to execute arbitrary code via a crafted document. This affects various versions of Word and Office on both Windows and Mac platforms.
Microsoft Office 2007 SP3 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted document, known as 'Microsoft Office Memory Corruption Vulnerability.'
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted template.
A vulnerability in Microsoft Windows and applications related to TrueType font handling allows remote attackers to execute arbitrary code. This affects multiple versions of operating systems and components, including .NET Framework and Silverlight.
A vulnerability in Microsoft Windows and applications that allows remote attackers to execute arbitrary code via a crafted TrueType font. This affects multiple versions of operating systems and components, including .NET Framework and Silverlight.