CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability'.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-1666.
A use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document.
A use-after-free vulnerability in Microsoft Word and related products allows remote attackers to execute arbitrary code via a crafted Office document.
A use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document.
The vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image.
Microsoft Windows systems, including Windows Server 2003 SP2, Windows Vista SP2, Windows 7 SP1, and others, have a vulnerability related to improper constraint of impersonation levels. This allows local users to gain elevated privileges via a crafted application.
A vulnerability in Microsoft Windows allows local users to gain elevated privileges through a crafted application. It affects multiple versions of Windows, including Windows Server 2003 R2, Windows Vista SP2, Windows 7 SP1, and newer.
Microsoft Word w różnych wersjach oraz usługi związane z Office umożliwiają zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany dokument RTF. Jest to znane jako 'Podatność na uszkodzenie pamięci w Microsoft Office'.
Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, known as 'Task Scheduler Elevation of Privilege Vulnerability.'
Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
Multiple stack-based buffer overflows in the ib_fill_isqlda function in dbdimp.c in DBD-Firebird before version 1.19 may allow remote attackers to have unspecified impact via unknown vectors that trigger an error condition, related to binding octets to columns.
The is_utf8_well_formed function in GNU less before version 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, leading to an out-of-bounds read.
Directory traversal vulnerability in inc/autoload.function.php in GLPI before version 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type passed to the getItemForItemtype function.
Fiyo CMS version 2.0.1.8 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters such as id, cat, user, level, email, and username to carry out an attack.
MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, are vulnerable to a denial of service attack. Attackers can exploit a large number of nested entity references in SVG files or XMP metadata in PDF files, leading to CPU and memory consumption.
MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allow remote attackers to cause a denial of service via an XML file containing an entity declaration with long replacement text and many references to this entity.
MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.
BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.