CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.
The Binary File Descriptor (BFD) library in GNU Binutils version 2.29.1 has a vulnerability that does not validate the symbol count. This can lead to denial of service through integer overflow and application crash or excessive memory allocation.
The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 lacks integer-overflow protection on 32-bit platforms, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.
The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not prevent negative pointers, which may lead to application crashes or other unspecified impacts via a crafted ELF file.
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.
The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.
The coff_slurp_line_table function in the Binary File Descriptor (BFD) library in version 2.29.1 of GNU Binutils allows remote attackers to cause a denial of service through a crafted PE file, leading to invalid memory access and application crash.
An issue was discovered on Siemens SICAM RTUs SM-2556 with specific firmware variants that allows unauthenticated remote attackers to execute arbitrary code via the integrated web server.
ASP.NET Core versions 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application.
Microsoft Excel 2016 Click-to-Run (C2R) contains a vulnerability that allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory.
.NET Core versions 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests.
Podatność w Microsoft Office 2007, 2010, 2013 i 2016 pozwala atakującemu na wykonanie dowolnego kodu w kontekście bieżącego użytkownika z powodu niewłaściwego zarządzania obiektami w pamięci. Jest to znane jako 'Podatność na uszkodzenie pamięci w Microsoft Office'.
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
A vulnerability in Microsoft Excel allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory.
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read. The attacker can also act on behalf of the victim, changing permissions and deleting content.
ChakraCore and Microsoft Edge in Windows 10 and Windows Server allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
Internet Explorer in Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10, and Windows Server 2016 allows an attacker to gain the same user rights as the current user due to how Microsoft browsers handle objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
ChakraCore and Microsoft Edge in Windows 10 and Windows Server have a vulnerability that allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory by the scripting engine.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS