CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.269 and 14.x through 16.x before version 16.0.0.305 on Windows and OS X and before version 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.269 and 14.x through 16.x before version 16.0.0.305 on Windows and OS X and before version 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2015-1477 is an SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! that allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads.
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
Multiple SQL injection vulnerabilities in the FailOverHelperServlet in ZOHO ManageEngine OpManager and IT360 allow remote attackers and remote authenticated users to execute arbitrary SQL commands.
In the web interface on SerVision HVG Video Gateway devices with firmware through version 2.2.26a100, remote authenticated users can gain elevated privileges by leveraging a cookie received in an HTTP response.
The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session.
The web interface on SerVision HVG Video Gateway devices with firmware before version 2.2.26a78 has a vulnerability that allows remote attackers to bypass authentication and gain administrative access by leveraging a cookie received in an HTTP response.
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a 'heap out of bounds condition.'
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted Yoda's crypter or mew packer file, related to a 'heap out of bounds condition.'
Huawei Quidway switches with firmware before V200R005C00SPC300 are vulnerable to an attack that allows remote attackers to gain privileges via a crafted packet.
Fortinet FortiAuthenticator 3.0.0 has default passwords for PostgreSQL users, making it easier for remote attackers to gain access to the system.