CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder.
Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website. This is a memory corruption vulnerability.
Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service through memory corruption via a crafted website.
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-4051.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
The vulnerability in win32k.sys in kernel-mode drivers of Microsoft Windows allows local users to gain elevated privileges via a crafted font file.
The vulnerability in Windows Installer allows local users to gain elevated privileges via a crafted application that invokes the repair feature for a different application.
In Windows systems, win32k.sys in kernel-mode drivers does not properly control access to thread-owned objects, allowing local users to gain elevated privileges via a crafted application.
There is a memory leak in the LRPC server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT. Attackers can exploit this vulnerability to cause a denial of service by sending messages with an invalid data view.
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-2944 is an SQL injection vulnerability in login.php in MegaLab The Uploader before version 2.0.5 that allows remote attackers to execute arbitrary SQL commands via the username parameter.
An unspecified vulnerability in the Automation Server in IBM Security AppScan Source versions 8 through 9.0.0.1 allows local users to gain privileges by executing a crafted service.
Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.
The EnergyWise module in Cisco IOS versions 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE versions 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet.
The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message.
The server in Cisco Unity Connection versions 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an 'HTTP Intercept' attack and leveraging the ability to read files within the context of the web-server user account.
Unity versions before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take keyboard focus when switching to the lock screen, allowing physically proximate attackers to bypass the lock screen.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS