CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X, and before 11.2.202.429 on Linux.
A use-after-free vulnerability in Adobe Flash Player before version 13.0.0.260 and in versions 14.x through 16.x before 16.0.0.257 on Windows and OS X, as well as before 11.2.202.429 on Linux, allows attackers to execute arbitrary code.
Adobe Flash Player and Adobe AIR in certain versions have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via out-of-bounds read.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.257 (Windows, OS X) and before 11.2.202.429 (Linux) contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.257 on various platforms allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
A heap-based buffer overflow vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X, and before 11.2.202.429 on Linux.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.245 (Windows, OS X) and before 11.2.202.429 (Linux) contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.257 (Windows, OS X) and before 11.2.202.429 (Linux) do not properly validate files, which may lead to unspecified impacts and attack vectors.
Podatność typu directory traversal w komponencie TS WebProxy w systemach Microsoft Windows umożliwia zdalnym atakującym uzyskanie wyższych uprawnień poprzez odpowiednio skonstruowaną ścieżkę w pliku wykonywalnym. Może to prowadzić do eskalacji uprawnień z niskiej integralności do średniej integralności.
A vulnerability in Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allows remote attackers to cause a denial of service through crafted username strings. This affects Internet Authentication Service (IAS) and Network Policy Server (NPS).
Buffer overflow in the Telnet service in Microsoft Windows systems, such as Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets.
The User Profile Service in Windows allows local users to gain elevated privileges by conducting a junction attack to load another user's UsrClass.dat registry hive.
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility components in Windows does not verify that an impersonation token is associated with an administrative account. This allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file.
SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids parameter.
A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long string in a UID command.
CVE-2014-100035 describes an SQL injection vulnerability in the admin interface of LicensePal ArcticDesk before version 1.2.5, allowing remote attackers to execute arbitrary SQL commands.
Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) version 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in download.php and main.php.
The mTouch Quiz before version 3.0.7 for WordPress has an SQL injection vulnerability in question.php that allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.
CVE-2014-100020 describes an SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 that allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS