CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allows remote attackers to execute arbitrary code via a crafted Office document.
Microsoft Office 2007 SP3 and Office 2010 SP2 have a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document, known as 'Microsoft Office Memory Corruption Vulnerability.'
The Windows font library in various Microsoft operating system versions and applications allows remote attackers to execute arbitrary code via a crafted embedded font, known as 'Graphics Memory Corruption Vulnerability.'
The Windows font library in various Microsoft operating system versions and Office applications allows remote attackers to execute arbitrary code via a crafted embedded font, known as 'Graphics Memory Corruption Vulnerability.'
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, and several versions of Office allows remote attackers to execute arbitrary code via a crafted embedded font, known as 'Graphics Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer have a vulnerability that allows remote attackers to execute arbitrary code via a crafted Office document.
The vulnerability in mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Android versions before 5.1.1 LMY48Z and 6.0 before 2015-12-01 contain a vulnerability in the mediaserver component that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The vulnerability in mediaserver in Android before version 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Display drivers in Android before version 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Display drivers in Android before version 5.1.1 LMY48Z and 6.0 before December 1, 2015, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Wi-Fi in Android 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application, potentially leading to Signature or SignatureOrSystem access.
SystemUI in Android 5.x before version 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application, enabling access to Signature or SignatureOrSystem levels.
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
The kernel in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application.
Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in mediaserver in Android before version 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Symfony versions 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 may be vulnerable to remote attacks via a timing attack. This affects classes related to token persistence and the CSRF implementation in the form component.
Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when 'DHCP Snooping' is enabled and either 'option82 insert' or 'option82 rebuild' is enabled on an interface, are vulnerable to remote attacks that can cause a denial of service (reboot) via crafted DHCP packets.