CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR and its SDK before version 18.0.0.199, allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code.
Buffer overflow in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code via unspecified vectors.
Buffer overflow in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code.
A heap-based buffer overflow vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 18.0.0.232 on Windows and OS X, and before 11.2.202.508 on Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as in Adobe AIR before version 18.0.0.199, allows attackers to execute arbitrary code.
Adobe Flash Player before version 18.0.0.232 on Windows and OS X and before version 11.2.202.508 on Linux, as well as Adobe AIR before version 18.0.0.199, allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
The lazy_bdecode function in BitTorrent DHT bootstrap server allows remote attackers to execute arbitrary code via a crafted packet, related to 'improper indexing.'
Belkin N300 Dual-Band Wi-Fi Range Extender with firmware before version 1.04.10 allows remote authenticated users to execute arbitrary commands via various parameters in form requests.
BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, allowing local HVM guest users to gain privileges by unplugging a block device twice.
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
A heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
The gesture handling code in Clutter before 1.16.2 allows physically proximate attackers to bypass the lock screen via certain (1) mouse or (2) touch gestures.
The stringprep_utf8_to_ucs4 function in libin before version 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.
Pacemaker before version 1.1.13 does not properly evaluate added nodes, allowing remote read-only users to gain privileges via an acl command.
SQL injection vulnerability in graphs.php in Cacti before version 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.