CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.
Microsoft Word and other Office applications have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted document.
Microsoft Excel versions 2007 SP3, 2010 SP2, 2013 SP1, 2016, and other related applications mishandle a registry check, allowing user-assisted remote attackers to execute arbitrary commands via crafted embedded content in a document.
Microsoft Excel and Excel services on SharePoint have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted document.
Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document.
Microsoft Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document.
Podatność w programach Microsoft Excel i Excel Viewer umożliwia zdalnym atakującym, przy wsparciu użytkownika, wykonanie dowolnych poleceń poprzez specjalnie przygotowaną komórkę, która jest niewłaściwie obsługiwana po kliknięciu. Jest to znana jako 'Podatność omijania zabezpieczeń Microsoft Office'.
Kernel-mode drivers in Microsoft Windows allow local users to gain elevated privileges via a crafted application. This affects multiple versions of Windows, including Vista, 7, 8.1, 10, and Windows Server.
The Graphics Component in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges via a crafted application.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Microsoft Edge Memory Corruption Vulnerability.'
In dotCMS before version 3.3.2, there is an SQL injection vulnerability in the REST API that allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.
Webdynpro in SAP Solman versions 7.1 to 7.31 allows remote attackers to obtain sensitive information via specific requests.
Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had a flaw that incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(). This allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; and 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot. This allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
A heap use after free in PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.
An issue was discovered in Apport before version 2.20.4 related to path traversal in the 'Package' and 'SourcePackage' fields of the crash file. An attacker can exploit this vulnerability to execute arbitrary Python files from the local system.
An issue was discovered in Apport before 2.20.4, where the CrashDB field is read and evaluated as Python code if it begins with '{'. This allows remote attackers to execute arbitrary Python code.
A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300, S7-400 oraz S7-410, która pozwala atakującemu z dostępem do sieci na port 102/tcp lub przez Profibus na uzyskanie poświadczeń z PLC, jeśli na urządzeniach skonfigurowano poziom ochrony 2.