CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Excel in various versions allows remote attackers to execute arbitrary code via a crafted Office document, related to a memory corruption vulnerability.
Microsoft Silverlight 5 w wersjach przed 5.1.41212.0 niewłaściwie obsługuje ujemne przesunięcia podczas dekodowania, co pozwala zdalnym atakującym na wykonanie dowolnego kodu lub spowodowanie odmowy usługi (uszkodzenie nagłówka obiektu) poprzez spreparowaną stronę internetową.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, known as 'Scripting Engine Memory Corruption Vulnerability.'
A vulnerability in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 related to improper DLL loading, allowing local users to gain elevated privileges via a crafted application.
The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511 allows remote attackers to bypass intended access restrictions and establish sessions for blank-password accounts via a modified RDP client.
The vulnerability in Microsoft Windows 7 SP1, 8, 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 is related to improper DLL loading. This allows local users to gain elevated privileges via a crafted application.
A vulnerability in Microsoft Windows related to improper DLL loading, allowing local users to gain elevated privileges via a crafted application.
The vulnerability in DirectShow in Microsoft Windows allows remote attackers to execute arbitrary code via a crafted file. It affects multiple versions of Windows, including Vista, 7, 8, 10, and servers 2008 and 2012.
A vulnerability in Microsoft Windows related to improper DLL loading, allowing local users to gain elevated privileges via a crafted application.
A vulnerability in Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document. This affects multiple versions of Office and Mac applications.
The vulnerability in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via unspecified vectors.
The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, allowing local users to gain privileges via a crafted application.
The sandbox implementation in Microsoft Windows (Vista SP2, Server 2008 SP2 and R2 SP1, Windows 7 SP1, 8, 8.1, Server 2012 Gold and R2, RT Gold and 8.1, and 10 Gold and 1511) mishandles reparse points, allowing local users to gain privileges via a crafted application.
Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka 'Microsoft Edge Memory Corruption Vulnerability.'
The VBScript 5.7 and 5.8 and JScript 5.7 and 5.8 engines in Internet Explorer 8 through 11 and other Microsoft products have a vulnerability that allows remote attackers to execute arbitrary code via a crafted website.
The mod_dialback module in Prosody before version 0.9.9 does not properly generate random values for the secret token used in server-to-server dialback authentication, making it easier for attackers to spoof servers via a brute force attack.
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Versions of BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem. This may allow remote attackers to gain access to AOM via an (1) expired or (2) default password.
The JPEGLSCodec::DecodeExtent function in Grassroots DICOM before version 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause application crashes via an embedded JPEG-LS image with dimensions larger than the selected region in a DICOM file.
Integer overflow in the ImageRegionReader::ReadIntoBuffer function in Grassroots DICOM before version 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, triggering a buffer overflow.