CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ContainerNode::parserRemoveChild function in Blink, used in Google Chrome before version 49.0.2623.75, mishandles widget updates, making it easier for remote attackers to bypass the Same Origin Policy via a crafted website.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR and its SDK before version 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Adobe Flash Player and Adobe AIR before specified versions allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data. This issue affects various software versions on Windows, OS X, and Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player and Adobe AIR before specified versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through crafted MPEG-4 data. This issue affects various software versions on Windows, OS X, and Linux.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux, allows attackers to execute arbitrary code via crafted MPEG-4 data.
Adobe Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.
Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file.
CSRF vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.
Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, allowing remote attackers to cause a denial of service (SNMP application restart) via a crafted packet.
A vulnerability in Cisco NX-OS from versions 4.0 to 6.1 on Nexus 1000V devices and UCS platforms allows remote attackers to cause a denial of service by sending crafted TCP packets to a device with a TIME_WAIT TCP session.
The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.
The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.
A memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt.
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g can lead to denial of service through heap memory corruption or NULL pointer dereference. Attackers can exploit long digit strings mishandled by the BN_dec2bn or BN_hex2bn functions.