CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric products allows remote attackers to execute arbitrary code.
Algorithmic complexity vulnerability in Cybozu Remote Service Manager allows remote attackers to cause a denial of service (CPU consumption) via colliding hash-table keys. This issue exists due to an incomplete fix for CVE-2014-1983.
Symantec PGP Universal Server and Encryption Management Server before version 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.
CoolType.dll in Adobe Reader and Acrobat in versions 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context.
The Bluetooth driver in Apple OS X before version 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app.
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
A vulnerability in Apple OS X before version 10.10 allows attackers to write to the sandbox-profile cache via a sandboxed app that includes a com.apple.sandbox segment in a path.
The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, allowing local users to gain privileges or spoof directory-service responses.
The kernel in Apple OS X before 10.10.2 does not properly validate IODataQueue object metadata fields, allowing attackers to execute arbitrary code in a privileged context.
IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8819 and CVE-2014-8820.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8819 and CVE-2014-8821.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8820 and CVE-2014-8821.
CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, allowing attackers to execute arbitrary code in a privileged context. This issue affects functions related to mmap archives.
An integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, allowing attackers to bypass intended access restrictions via a crafted app.
The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app.
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type. This allows attackers to execute arbitrary code in a _networkd context via a crafted XPC message from a sandboxed app.