CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of crafted packets.
The vulnerability in vbscript.dll in Microsoft VBScript 5.6 through 5.8, used with Internet Explorer 6 through 11, allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly initialize guest OS system data structures, allowing guest OS users to execute arbitrary code on the host OS by leveraging guest OS privileges.
Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, allowing guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-2401 and CVE-2015-2408.
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka 'Internet Explorer Memory Corruption Vulnerability,' a different vulnerability than CVE-2015-2388.
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-2389 and CVE-2015-2411.
The BFD daemon in Juniper Junos OS before versions 12.1X44-D50, 12.1X46-D35, 12.1X47-D25, 12.3R10, 12.3X48-D15, 13.2R8, 13.3R6, 14.1R5, 14.1X50-D85, 14.1X55-D20, 14.2R3, 15.1R1, and 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of BGP-VPLS advertisements with updated BGP local preference values. This affects multiple versions of the OS before their respective patches.
A vulnerability in Juniper Junos OS allows remote attackers to cause a denial of service by sending a large number of requests, triggering a TCP connection to move to the LAST_ACK state while there is more data to send.
Django versions 1.8.x before 1.8.3 contain a vulnerability in the URL validator that allows remote attackers to cause a denial of service via unspecified vectors.
Django versions before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 are vulnerable to denial of service attacks. Attackers can exploit unique session keys to consume session store resources.
The Juniper SRX Series services gateways with Junos OS versions 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the 'set system ports console insecure' feature. This allows physically proximate attackers to gain administrative privileges by leveraging access to the console port.
A stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before version 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Integer overflow in filter/texttopdf.c in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow.
Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in cups-filters before version 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon 2.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
The REST API in IBM Business Process Manager (BPM) allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.
EMC RecoverPoint for Virtual Machines (VMs) version 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
The vmware-vmx.exe in VMware Workstation and VMware Player has a vulnerability that allows host OS users to gain host privileges by injecting a thread. This issue affects versions prior to 10.0.7 and 11.1.1 for Workstation and prior to 6.0.7 and 7.1.1 for Player.