CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The NVIDIA NVStreamKMS.sys service in NVIDIA Quadro, NVS, and GeForce products improperly validates user-supplied data through its API entry points, leading to elevation of privilege.
For NVIDIA Quadro, NVS, and GeForce products, there is a Remote Desktop denial of service vulnerability. A successful exploit will result in a kernel null pointer dereference, causing a blue screen crash.
CVE-2016-3161 concerns a vulnerability in NVIDIA Quadro, NVS, and GeForce products related to unquoted service paths in Windows. Exploiting this vulnerability may allow malicious code to execute at the system or user privilege level.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have a use-after-free vulnerability that can be exploited by an attacker. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the 'crafted image file' approach. This issue is related to an 'Insecure Sign Extension' problem affecting the ImagingNew in Storage.c component.
The 'image' module in Moodle 3.1.2 has an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
Moodle 3.1.2 has an unrestricted file upload vulnerability in the 'legacy course files' and 'file manager' modules. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.
In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.