CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors.
A use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux, and in Adobe AIR before 18.0.0.180 allows attackers to execute arbitrary code.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before 18.0.0.180, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player and Adobe AIR in specific versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging unspecified 'type confusion'.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK versions before 18.0.0.180, allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion' vulnerability.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion' vulnerability.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion' vulnerability.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux. This vulnerability allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The Utf8DecoderBase::WriteUtf16Slow function in Google V8, used in Node.js and io.js, does not verify memory availability for a UTF-16 surrogate pair. This can lead to denial of service due to memory corruption or other unspecified impacts.
The Easy2Map plugin before version 1.2.5 for WordPress contains multiple SQL injection vulnerabilities in includes/Function.php, allowing remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, allowing remote attackers to execute arbitrary code by uploading a crafted file.
CVE-2015-5452 is an SQL injection vulnerability in Watchguard XCS versions 9.2 and 10.0 before build 150522, allowing remote attackers to execute arbitrary SQL commands via the sid cookie.
In ISC BIND versions 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, remote attackers can cause a denial of service by crafting malicious zone data and querying for a name in that zone.
SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username.
SQL injection vulnerability in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.
The Hospira LifeCare PCA Infusion System version 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.
A stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier allows remote attackers to execute arbitrary code.
The Hospira LifeCare PCA Infusion System before version 7.0 does not validate network traffic associated with sending a drug library, software update, or configuration change. This allows remote attackers to modify settings or medication data via packets on TELNET, HTTP, HTTPS, or UPNP ports.
The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.