CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player versions before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allow attackers to bypass intended access restrictions via unspecified vectors.
Adobe Flash Player versions before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, and Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, and Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code.
The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for the files /etc/sysconfig/tomcat and /etc/tomcat/tomcat.conf. This allows local users to gain privileges by leveraging membership in the tomcat group.
The Tomcat package on Red Hat Enterprise Linux 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, allowing local users to gain root privileges by leveraging membership in the tomcat group.
SAP Console version 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry.
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to modify files, rename files, create directories, or delete directories via crafted packets.
Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 is vulnerable to remote attacks that can lead to ALM service outage by sending crafted packets to TCP port 4410.
The Ruckus Wireless H500 web management interface is vulnerable to authenticated command injection. An attacker can exploit this vulnerability to execute arbitrary system commands.
The updater subsystem in Intel SSD Toolbox before version 3.3.7 allows local users to gain privileges via unspecified vectors.
A use-after-free vulnerability in the __sys_recvmmsg function in the Linux kernel before version 4.5.2 allows remote attackers to execute arbitrary code via mishandled error processing during a recvmmsg system call.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for the data length.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted visualizer data length.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before October 5, 2016, allows attackers to cause a denial of service or possibly have unspecified other impact via crafted parameter data.
The Qualcomm QDSP6v2 driver in Android before 2016-10-05 has a vulnerability that allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length.
The Qualcomm MDSS driver in Android before 2016-10-05 has a vulnerability that allows attackers to cause a denial of service through invalid pointer access. It may also lead to unspecified other impacts.
The gbk2utf module in Qualcomm Wi-Fi in Android before 2016-10-05 allows remote attackers to cause a framework crash or possibly have unspecified other impact via an access point with a malformed SSID with GBK encoding.