CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MuJS before version 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct 'denial of service' attacks by using malformed labeled break/continue in JavaScript, related to a NULL pointer dereference issue affecting the jscompile.c component.
In Exponent CMS v2.4.0 and older, the 'target' parameter of the 'DragnDropReRank' function is used without filtration, leading to SQL injection vulnerability.
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.
Integer overflow in SystemUI in KK(4.4) and L(5.0/5.1) on Samsung Note devices allows attackers to cause a denial of service (UI restart) via vectors involving APIs and an activity that computes an out-of-bounds array index.
CVE-2016-9274 in Git 1.x for Windows has an untrusted search path vulnerability that allows local users to gain privileges via a malicious git.exe file in the current working directory.
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
W systemie Linux w wersjach 2.x do 4.x przed 4.8.3 występuje warunkowa rywalizacja w pliku mm/gup.c, która pozwala lokalnym użytkownikom na uzyskanie uprawnień poprzez niewłaściwe zarządzanie funkcją copy-on-write (COW), co umożliwia zapis do pamięci tylko do odczytu. Ta podatność była wykorzystywana w praktyce w październiku 2016 roku, znana jako 'Dirty COW'.
In Dotclear versions up to 2.10.4, there is an unrestricted file upload vulnerability in the 'Install or upgrade manually' module that allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with a zip extension.
The installation script studioexpressinstall for Teradata Studio Express 15.12.00.00 creates files in /tmp insecurely. A malicious local user could create a symlink in /tmp and possibly clobber system files or perhaps elevate privileges.
The perl script /opt/teradata/gsctools/bin/t2a.pl in Teradata Virtual Machine Community Edition v15.10 creates files in /tmp in an insecure manner, which may lead to elevated code execution.
Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr, which could allow a local user to modify its contents and execute commands as root.
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Podatność w bibliotece czcionek Windows (atmfd.dll) umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez specjalnie przygotowaną stronę internetową. Dotyczy to wielu wersji systemu Windows, w tym Vista, 7, 8.1, 10 oraz serwerów Windows.
Sterowniki w trybie jądra w systemach Microsoft Windows Vista SP2, Windows Server 2008 SP2 i R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold i R2, Windows RT 8.1, Windows 10 Gold, 1511 i 1607 oraz Windows Server 2016 umożliwiają lokalnym użytkownikom uzyskanie uprawnień za pomocą spreparowanej aplikacji, znanej jako 'Win32k Elevation of Privilege Vulnerability'.
Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, allowing remote authenticated users to gain privileges via unknown vectors.
The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, allowing remote authenticated users to gain privileges via unspecified vectors.
Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors.
Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, allowing remote authenticated users to gain privileges via unknown vectors.
The vulnerability in Microsoft Video Control allows remote attackers to execute arbitrary code via a crafted file. It affects Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 in Gold, 1511, and 1607 versions.