CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in the Navigation implementation in Google Chrome before version 49.0.2623.108 may allow remote attackers to cause a denial of service or possibly have unspecified other impact.
Implementacja metody Array.prototype.concat w Google V8, używana w Google Chrome przed wersją 49.0.2623.108, nieprawidłowo uwzględnia typy danych elementów. To może pozwolić zdalnym atakującym na spowodowanie odmowy usługi (odczyt poza zakresem) lub potencjalnie inny nieokreślony wpływ za pomocą spreparowanego kodu JavaScript.
A stack-based buffer overflow in manager.exe in Autodesk Backburner 2016 allows remote attackers to execute arbitrary code or cause a denial of service. This affects version 2016.0.0.2150 and earlier.
The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the nsrd, nsrexecd, and portmap executable files, allowing local users to gain privileges via a Trojan horse file.
PCRE 8.35 has an issue with optimizing nested alternatives, which can lead to denial of service through stack memory corruption. Remote attackers can exploit this vulnerability by sending a crafted string.
The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of service (device reload) via a crafted header in a packet.
Cisco IOS versions 15.3 and 15.4, Cisco IOS XE versions 3.8 through 3.11, and Cisco Unified Communications Manager are vulnerable to an attack that can cause device reload via malformed SIP messages.
The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet.
Cisco IOS versions 15.0 through 15.5 and IOS XE versions 3.3 through 3.16 are vulnerable to an attack that can lead to denial of service via a crafted DHCPv6 Relay message. Attackers can remotely cause the device to reload.
The Wide Area Application Services (WAAS) Express implementation in Cisco IOS versions 15.1 through 15.5 allows remote attackers to cause a denial of service (device reload) via a crafted TCP segment.
Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.
WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
WebKit in iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The Web Server in Apple OS X Server before version 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
QuickTime in Apple OS X before version 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop file.
QuickTime in Apple OS X before version 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image.
QuickTime in Apple OS X before version 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image.
The Profiles component in Apple iOS before 9.3 does not properly validate certificates, allowing attackers to spoof an MDM profile trust relationship via unspecified vectors.