CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.
QNAP QTS before version 4.2.6 build 20170517 has a flaw in the change password function.
On D-Link DIR-605L devices, firmware before version 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.
In version 2.3.0 of SimpleCE, a CSRF vulnerability can be exploited to add an administrator account or change its settings, including the password.
In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.
The Avira Mobile Security app before version 1.5.11 for iOS sends sensitive login information in cleartext.
CVE-2017-9670 describes an uninitialized stack variable vulnerability in the load_tic_series() function in set.c in gnuplot 5.2.rc1. An attacker can cause Denial of Service (segmentation fault and memory corruption) or possibly have unspecified other impacts when a victim opens a specially crafted file.
IBM API Connect version 5.0.0.0 could allow a remote attacker to obtain sensitive information due to improper handling of requests to the Developer Portal.
IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
Infotecs ViPNet Client and Coordinator before version 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folder. The attack succeeds due to incorrect folder permissions and a lack of integrity and authenticity checks.
A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows 8 allows an elevation of privilege when it fails to properly handle objects in memory.
Microsoft Edge in Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 has a vulnerability that allows an attacker to obtain information, potentially leading to further compromise of the user's system. The issue arises from improper handling of objects in memory by Microsoft Edge.
Microsoft Edge in Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 has a vulnerability that allows an attacker to obtain information that could lead to further compromising the user's system. The issue arises from improper handling of objects in memory by Microsoft Edge.
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allows an attacker to execute arbitrary code in the context of the current user due to improper access to objects in memory.
Podatność w systemach Microsoft Windows pozwala atakującemu na przejęcie kontroli nad systemem, gdy funkcja wyszukiwania Windows nieprawidłowo obsługuje obiekty w pamięci. Dotyczy to wielu wersji systemów operacyjnych, w tym Windows XP, Vista, 7, 8, 10 oraz serwerów Windows.
Uniscribe in Windows allows remote code execution due to improper handling of objects in memory. This affects multiple versions of Windows operating systems and Microsoft Office.
Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 have a remote code execution vulnerability due to the way graphics handle objects in memory.
A vulnerability in Microsoft browsers on Windows systems allows an attacker to execute arbitrary code in the context of the current user. The issue occurs when JavaScript engines fail to render objects in memory.
Microsoft browsers in Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10, and Windows Server 2016 have a vulnerability that allows an attacker to execute arbitrary code in the context of the current user. This issue occurs when JavaScript engines fail to render objects in memory.
Microsoft Edge in Windows 10 version 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript scripting engine fails to handle objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.