CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Task Scheduler of Windows 8, 8.1, Windows Server 2012, and Windows RT allows local users to gain elevated privileges via an application that schedules a crafted task.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in the Internet Explorer browser.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website, related to memory corruption.
A heap-based buffer overflow exists in Adobe Flash Player and Adobe AIR that may allow attackers to execute arbitrary code. This affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR across various platforms.
Adobe Flash Player and Adobe AIR in certain versions improperly restrict memory address discovery, allowing attackers to bypass the ASLR protection mechanism.
A heap-based buffer overflow in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR across various platforms.
Adobe Flash Player and Adobe AIR in specific versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. This affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
A use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and in 14.x and 15.x before 15.0.0.152 on Windows and OS X, as well as before 11.2.202.406 on Linux, allows attackers to execute arbitrary code.
Adobe Flash Player and Adobe AIR versions before 13.0.0.244 and 15.0.0.152 on Windows and OS X, and before 11.2.202.406 on Linux, as well as Adobe AIR SDK before 15.0.0.249, allow attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This is a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0555.
Adobe Flash Player and Adobe AIR in specific versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Adobe Flash Player and Adobe AIR in specific versions on various operating systems contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through unspecified vectors. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Adobe Flash Player and Adobe AIR in specific versions across various platforms have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption.
Adobe Flash Player and Adobe AIR in certain versions allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
Adobe Flash Player and Adobe AIR in specific versions are vulnerable to arbitrary code execution or denial of service due to memory corruption. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Heap-based buffer overflow in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to 'unbalanced quotes.'
The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
SolarWinds Log and Event Manager before 6.0 uses 'static' credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
An unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x before 6.0.3, and 6.5.x before 6.5.1 allows remote attackers to gain privileges and access sensitive information or modify data.