CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A stack-based buffer overflow in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data.
Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors.
A use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback.
Adobe Flash Player versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allow attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified 'type confusion' vulnerability.
An untrusted search path vulnerability in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.343 and 19.x through 21.x before version 21.0.0.213 on Windows and OS X and before version 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allow attackers to bypass the ASLR protection mechanism via JIT data.
McAfee Advanced Threat Defense (ATD) before version 3.4.8.178 may allow remote attackers to bypass malware detection by leveraging information about the parent process.
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites. This can lead to phishing attacks or potentially cross-site scripting (XSS) attacks via a URL containing basic authentication.
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
The Java Startup Framework (jstart) in SAP JAVA AS versions 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request.
The Internet Communication Manager (ICM) in SAP JAVA AS versions 7.2 to 7.4 allows remote attackers to cause a denial of service through heap memory corruption and process crash via a crafted HTTP request, related to the IctParseCookies function.
The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify various field types, potentially leading to unspecified impacts.
The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, potentially leading to unspecified impacts.
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.