CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple stack-based buffer overflows in HWOPOSScale.ocx and HWOPOSSCANNER.ocx in Honeywell OPOS Suite before version 1.13.4.15 allow remote attackers to execute arbitrary code via a crafted file that is improperly handled by the Open method.
There is a stack-based buffer overflow in the K7Sentry.sys kernel mode driver, allowing local users to execute arbitrary code with kernel privileges.
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
A heap-based buffer overflow exists in the K7FWFilt.sys kernel mode driver, allowing local users to execute arbitrary code with kernel privileges via a crafted parameter in a DeviceIoControl API call. This affects multiple K7 Computing products.
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a symlink or hard link attack in an image archive during a pull or load operation.
The mdp_lut_hw_update function in the MDP display driver for Linux kernel 3.x does not validate certain start and length values within an ioctl call, allowing attackers to gain privileges via a crafted application.
The Server Side Includes (SSI) implementation in the File Upload BBS component in ULTRAPOP.JP i-HTTPD allows remote attackers to execute arbitrary commands by uploading files containing commands in SSI directives.
Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted column alias.
Integer overflow in Trihedral Engineering VTScada versions 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation.
The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) versions 6.0.1 through 6.1.1 allows remote authenticated users to gain privileges via vectors involving the 'Connect (by) Using VMRC' function.
CVE-2014-7192 describes a vulnerability in the syntax-error package before version 1.1.1, used in Node.js 0.10.x, allowing remote attackers to execute arbitrary code via a crafted file.
BIND versions 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 do not limit delegation chaining, allowing remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.
Microsoft Internet Explorer versions 6 through 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer 10 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service through a crafted website, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka 'Internet Explorer Memory Corruption Vulnerability.'
A use-after-free vulnerability in Microsoft Office 2007 SP3, 2010 SP2, 2013 Gold, SP1, and SP2, and 2013 RT Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document.