CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before version 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before versions 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, allowing man-in-the-middle attackers to perform downgrade attacks and impersonate users by modifying the client-server data stream.
HPE Universal CMDB Foundation versions 10.0, 10.01, 10.10, 10.11, and 10.20 allow remote attackers to obtain sensitive information or conduct URL redirection attacks via unspecified vectors.
Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors.
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before version 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
Sterownik w trybie jądra w systemach Microsoft Windows Vista SP2, Windows Server 2008 SP2 i R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold i R2, Windows RT 8.1 oraz Windows 10 Gold i 1511 pozwala lokalnym użytkownikom na uzyskanie uprawnień poprzez specjalnie przygotowaną aplikację. Jest to podatność znana jako 'Win32k Elevation of Privilege Vulnerability'.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Sterownik w trybie jądra w systemach Microsoft Windows Vista SP2, Windows Server 2008 SP2 i R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold i R2, Windows RT 8.1 oraz Windows 10 Gold i 1511 pozwala lokalnym użytkownikom na uzyskanie uprawnień poprzez specjalnie przygotowaną aplikację. Jest to podatność znana jako 'Win32k Elevation of Privilege Vulnerability'.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, known as "Internet Explorer Information Disclosure Vulnerability".
Microsoft Internet Explorer 11 mishandles DLL loading, allowing local users to gain privileges via a crafted application.
Microsoft Internet Explorer 9 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted website.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-0155 and CVE-2016-0156.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-0155 and CVE-2016-0157.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-0156 and CVE-2016-0157.
A vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
The OLE vulnerability in Microsoft Windows allows remote attackers to execute arbitrary code via a crafted file. This affects multiple versions of the operating system, including Windows Vista, Windows 7, and Windows 8.1.
Podatność w subsystemie uruchomieniowym klient-serwer (CSRSS) w systemach Microsoft Windows 8.1, Windows Server 2012 oraz Windows 10 pozwala lokalnym użytkownikom na uzyskanie podwyższonych uprawnień poprzez odpowiednio przygotowaną aplikację. Jest to znane jako 'obejście zabezpieczeń CSRSS w Windows'.
HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests.
Microsoft .NET Framework versions 4.6 and 4.6.1 mishandle library loading, allowing local users to gain privileges via a crafted application.