CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, posing a significant security threat.
The font library in Microsoft Windows and certain applications allows remote attackers to execute arbitrary code via a crafted embedded font, known as 'Graphics Memory Corruption Vulnerability'.
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application.
Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer have a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
Microsoft Excel 2007 SP3, Excel 2010 SP2, and Excel Services on SharePoint Server 2007 SP3 and 2010 SP2 have a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application.
A vulnerability in Microsoft Word and related products allows remote attackers to execute arbitrary code via a crafted Office document. This affects Word versions 2007, 2010, 2013, and various Office-related services.
A vulnerability in Microsoft Excel and Word allows remote attackers to execute arbitrary code via a crafted Office document. This affects Excel versions 2007 SP3, 2010 SP2, 2013 SP1, 2016, and Word 2016 for Mac.
A vulnerability in Hyper-V on Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application.
The Hyper-V vulnerability in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application.
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application.
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 is vulnerable to remote attacks that can cause a denial of service via a crafted request.
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
The device management command line interface (CLI) in Palo Alto Networks PAN-OS before version 5.0.18 and in versions 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
Huawei Policy Center with software versions before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.
CVE-2016-3172 is a SQL injection vulnerability in tree.php in Cacti version 0.8.8g and earlier. It allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
The __switch_to function in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, allowing local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.