CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Kernel-mode drivers in Microsoft Windows 10 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, leading to an elevation of privilege vulnerability.
The PDF library in Microsoft Edge on Windows 8.1, Windows Server 2012 and R2, Windows RT 8.1, and Windows 10 (1511 and 1607) allows remote attackers to execute arbitrary code via a crafted PDF file.
Microsoft XML Core Services (MSXML) in multiple Windows versions improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site (Information Disclosure).
Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, allowing attackers to execute arbitrary code on a target OS.
The vulnerability in Microsoft Excel 2016, 2010 SP2, 2013 RT SP1, and Office Web Apps Server 2013 SP1 allows remote attackers to execute arbitrary code or cause a denial of service through a crafted document. This is a memory corruption issue.
Microsoft Word 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document. This vulnerability is different from those described in other CVEs.
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
CVE-2017-0015 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
The Windows Graphics Component in Microsoft Office 2010 SP2 and various versions of Windows allows remote attackers to execute arbitrary code via a crafted website. This is a remote code execution vulnerability that is different from that described in CVE-2017-0108.
CVE-2017-0010 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
The vulnerability in Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted document, known as 'Microsoft Office Memory Corruption Vulnerability.'
Podatność w interfejsie GDI systemu Windows umożliwia lokalnym użytkownikom uzyskanie podwyższonych uprawnień poprzez specjalnie przygotowaną aplikację. Dotyczy to wielu wersji systemu Windows, w tym Vista, 7, 8.1 oraz 10.
Interfejs GDI w systemach Microsoft Windows umożliwia lokalnym użytkownikom uzyskanie podwyższonych uprawnień poprzez specjalnie przygotowaną aplikację. Ta podatność dotyczy wielu wersji systemów Windows, w tym Vista, 7, 8.1, 10 oraz serwerów Windows 2008 i 2012.
Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.
An issue was discovered in CHICKEN Scheme through version 4.12.0 related to allocating an SRFI-4 vector in unmanaged memory. The vector size was used in unsanitised form as an argument to malloc(), which could lead to segfaults or buffer overflows.
Apache Camel's Validation Component is vulnerable to SSRF (Server-Side Request Forgery) via remote DTDs and XXE (XML External Entity).
The SVG Salamander (svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any folder outside the FTP root Directory.
A third party development library included with Drupal 8 development dependencies is vulnerable to remote code execution. This vulnerability is mitigated by the default .htaccess protection against PHP execution and the fact that Composer development dependencies aren't normally installed.