CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer versions 6 through 10 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer w wersjach 7-11 umożliwia zdalnym atakującym uzyskanie uprawnień poprzez specjalnie przygotowaną stronę internetową, co jest określane jako 'Podatność na podniesienie uprawnień w Internet Explorer'.
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.
A vulnerability in Microsoft Office and Word allows remote attackers to execute arbitrary code via crafted properties in a Word document. This affects Office 2007, 2010, and Office for Mac 2011.
The fastfat.sys driver in kernel mode for Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 has a memory allocation issue. This allows physically proximate attackers to execute arbitrary code or cause a denial of service by connecting a crafted USB device.
Podatność w systemach Microsoft Windows umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany obiekt OLE w dokumencie Office. Wykorzystano ją w atakach typu 'Sandworm' od czerwca do października 2014 roku.
Podatność w win32k.sys w sterownikach trybu jądra systemu Microsoft Windows umożliwia lokalnym użytkownikom uzyskanie podwyższonych uprawnień poprzez specjalnie przygotowaną aplikację. Wykorzystanie tej podatności miało miejsce w październiku 2014 roku.
A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.
A use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 33.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code. These issues are related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Integer overflow in Adobe Flash Player before version 13.0.0.250 and 14.x and 15.x before version 15.0.0.189 on Windows and OS X and before version 11.2.202.411 on Linux, as well as in Adobe AIR before version 15.0.0.293, Adobe AIR SDK before version 15.0.0.302, and Adobe AIR SDK & Compiler before version 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player and Adobe AIR in specific versions have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects versions before 13.0.0.250 for Flash Player and before 15.0.0.293 for Adobe AIR.
Adobe Flash Player and Adobe AIR in specific versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects versions before 13.0.0.250 for Flash Player and before 15.0.0.293 for Adobe AIR.
Multiple SQL injection vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in a browse action to index.php or (2) unspecified parameters to admin.php.
Juniper Junos versions before R11 in 11.4, before R9 in 12.1, and other listed versions are vulnerable to an attack that can lead to denial of service. Attackers can exploit specially crafted fragmented packets of CLNP, IPv4, or IPv6 to block the em driver and reset the FPC.
In Juniper Junos versions before R12, 12.1 before R10, and others listed, configuring a RADIUS accounting server may create an entry in /var/etc/pam_radius.conf, allowing remote attackers to bypass authentication.