CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified vectors.
The client in IBM Tivoli Storage Manager (TSM) has a vulnerability that allows local users to gain privileges via a crafted DSO file. This issue affects versions 6.3 before 6.3.2.3, 6.4 before 6.4.2.2, and 7.1 before 7.1.1.3.
CVE-2014-6154 describes a directory traversal vulnerability in IBM Optim Performance Manager for DB2 that allows remote attackers to access arbitrary files by using .. (dot dot) in a URL.
CVE-2015-1471 is an SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 that allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
A race condition in the MACE implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic.
The Zone-Based Firewall implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers incorrect kernel-timer handling.
Multiple SQL injection vulnerabilities in u5CMS before version 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter in several files and other parameters in various admin scripts.
CVE-2015-1518 is an SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before version 2.3.0. It allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
CVE-2015-1172 describes an unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme version 0.6 and earlier for WordPress. This allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension and then accessing it via a direct request.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.
The vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and other components allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Office document.
A vulnerability in Microsoft Excel and related tools allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Office document.
A vulnerability in Microsoft Windows allows local users to gain elevated privileges by exploiting incorrect impersonation handling in a process that uses the SeAssignPrimaryTokenPrivilege privilege.
A double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application.
The vulnerability in win32k.sys allows local users to gain elevated privileges through a crafted application. It affects various versions of Microsoft Windows operating systems, including Windows Server 2003, Windows Vista, Windows 7, and Windows 8.
Microsoft Internet Explorer versions 6 through 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.