CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
Adobe Experience Manager Forms versions 6.2, 6.1, and 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.
In F5 BIG-IP versions 12.1.0 through 12.1.2, a race condition can occur that may delay the enforcement of permissions by iControl. If the role_map is not reloaded after permissions are changed, a user may gain access to resources they should not have access to.
In F5 BIG-IP versions 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
In F5 BIG-IP versions 12.0.0 through 12.1.2, an authenticated attacker may gain elevated privileges through a crafted iControl REST connection.
The vulnerability in Apache Cordova Android 5.2.2 and earlier allows other installed applications to read log data. Logs are not sandboxed per application in Android versions prior to 4.1.
The Microsoft Malware Protection Engine improperly scans a specially crafted file, leading to memory corruption. This may allow for remote code execution.
EMC Mainframe Enablers ResourcePak versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.
A flaw in Brocade NetIron 05.8.00 and later releases up to 06.1.00 involves improper checks for unusual or exceptional conditions, potentially leading to a crash of the management module when continuously scanned on port 22.
There is a privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b. This allows an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface.
The unixsocket.c file in lxterminal up to version 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch) or possibly have other impact (bypassing terminal access control).
Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long 'Register a new card' input fields. This may lead to local code execution with untrusted input to SmartDiag.exe or SymDiag.exe.
An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.
A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur during a failed parse of a Cc header containing multiple e-mail addresses.
The read_1g function in stream.c in liblrzip.so in lrzip version 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
Deserialization vulnerability in lintian through version 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file.
The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.
The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.