CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The asm.js implementation in Mozilla Firefox before version 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped. This allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 38.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via specified commands.
Adobe Flash Player versions before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, as well as Adobe AIR and its SDK versions before 17.0.0.172, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.289 and 17.0.0.172 contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This is a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.
Adobe Flash Player versions before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, as well as Adobe AIR and its SDK versions before 17.0.0.172, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, as well as in Adobe AIR before 17.0.0.172, allows attackers to execute arbitrary code via unspecified vectors.
Integer overflow in Adobe Flash Player before version 13.0.0.289 and in versions 14.x to 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, as well as in Adobe AIR and its SDK before version 17.0.0.172, allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, as well as before 11.2.202.460 on Linux. It also affects Adobe AIR and Adobe AIR SDK before 17.0.0.172, allowing attackers to execute arbitrary code.
Adobe Flash Player and Adobe AIR in specific versions have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects versions before 13.0.0.289 for Flash Player and before 17.0.0.172 for Adobe AIR.
Adobe Flash Player versions before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, as well as Adobe AIR and its SDK before version 17.0.0.172, allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion' vulnerability.
Adobe Reader and Acrobat in versions 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors.
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors.