CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler ADC and NetScaler Gateway before version 9.3-66.5 and 10.x before version 10.1-122.17.
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
In version 3.30.0 of Super, the super.c file does not check the return value of the setuid function when the -F flag is set. This allows local users to gain privileges via unspecified vectors, known as an RLIMIT_NPROC attack.
FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
A use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to execute arbitrary code or cause a denial of service through improper handling of an imgLoader object during an image-resize operation.
The Web Notification API in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to bypass source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page.
The sse2_composite_src_x888_8888 function in the Pixman library, used in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause application crashes by painting on a CANVAS element.
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted VIDEO element in an HTML document.
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service via crafted content.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.
Android versions before 4.4 do not properly manage the seeding of the OpenSSL PRNG, making it easier for attackers to defeat cryptographic protection mechanisms by leveraging the PRNG within multiple applications.
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted request.
Simple Machines Forum (SMF) versions 2.0.6, 1.1.19, and earlier allow remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters.
Juvia uses the same secret key for all installations, allowing remote attackers to leverage the secret key in app/config/initializers/secret_token.rb, which may lead to unspecified impact on cookies.
Buffer overflow in Adobe Flash Player before version 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CookieInterceptor in Apache Struts before version 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, allowing remote attackers to 'manipulate' the ClassLoader and execute arbitrary code via a crafted request.
ParametersInterceptor in Apache Struts before version 2.3.20 does not properly restrict access to the getClass method, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request.