CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Word 2007 SP3 and 2010 SP1 and SP2, along with Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (.doc) format to a newer format. This allows remote attackers to execute arbitrary code via a crafted document.
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 6 through 9 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Buffer overflow in Adobe Flash Player before version 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, as well as in Adobe AIR before 13.0.0.83 on Android, allows attackers to execute arbitrary code.
Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data.
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to videos.php or channels.php.
The Advanced Forum Signatures plugin version 2.0.4 for MyBB contains an SQL injection vulnerability in signature.php, allowing remote attackers to execute arbitrary SQL commands via the afs_bar_right parameter.
The Advanced Forum Signatures plugin version 2.0.4 for MyBB contains multiple SQL injection vulnerabilities in the signature.php file. Remote attackers can execute arbitrary SQL commands through various parameters.
Implementacje TLS i DTLS w OpenSSL 1.0.1 przed wersją 1.0.1g nieprawidłowo obsługują pakiety rozszerzenia Heartbeat, co pozwala zdalnym atakującym na uzyskanie wrażliwych informacji z pamięci procesu poprzez odpowiednio skonstruowane pakiety, co prowadzi do nadmiernego odczytu bufora. Jest to znane jako błąd Heartbleed.
Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code.
Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.
A stack-based buffer overflow in Core FTP before version 2.2 build 1785 allows remote FTP servers to execute arbitrary code via a crafted directory name in a CWD command reply.
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before version 2.5.1.12123_2_7 allows remote attackers to execute arbitrary code via a long string to the password argument.
Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in search.rb or puppetclass.rb, related to the search mechanism.
The Mingle Forum plugin for WordPress before version 1.0.34 contains multiple SQL injection vulnerabilities in wpf.class.php. Remote attackers can execute arbitrary SQL commands via the id parameter in various actions.
A heap-based buffer overflow in Tracker Software PDF-XChange before version 2.5.208 allows remote attackers to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream in a PDF file.
A heap-based buffer overflow in Autodesk SketchBook for Enterprise 2014, Pro, and Express before 6.25, and Copic Edition before 2.0.2 allows remote attackers to execute arbitrary code via RLE-compressed channel data in a PSD file.
Multiple SQL injection vulnerabilities in vTiger CRM versions 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters in SOAP methods to gain access to the database.