CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in the browser.
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-6066, CVE-2015-6071, CVE-2015-6074, CVE-2015-6076, and CVE-2015-6087.
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-6078.
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Microsoft Browser Memory Corruption Vulnerability.'
A vulnerability in Microsoft Excel and related products allows remote attackers to execute arbitrary code via a crafted Office document. This affects Excel versions 2007, 2010, 2013, 2016, as well as Excel for Mac, Office Compatibility Pack, and Excel Viewer.
Versions of Microsoft Office 2007, 2010, 2013, and 2016, as well as Skype for Business and Lync 2013 SP1, have a vulnerability that allows remote attackers to bypass a sandbox protection mechanism. Attackers can gain elevated privileges by visiting a crafted website in Internet Explorer.
A vulnerability in Microsoft Windows allows local users to gain elevated privileges via a crafted application that triggers a Winsock call referencing an invalid address.
Microsoft Internet Explorer 9 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The vulnerability in the PDF viewer in Google Chrome before version 46.0.2490.86 allows remote attackers to bypass the Same Origin Policy via unintended embedder or unintended plugin loading.
The SQL interface in SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via unspecified vectors related to 'SQL Login'.
The Extended Application Services (XS) in SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via unspecified vectors related to 'HTTP Login'.
SAP HANA Database 1.00 SPS10 and earlier do not require authentication, allowing remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet.
Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to 'phase one 0x412 tag,' which triggers a heap-based buffer overflow.
A .desktop file in the Debian openjdk-7 package version 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, allowing remote attackers to execute arbitrary code via a JAR file.
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
In the MIT Kerberos 5 library before version 1.14, there is an issue with an inappropriate context handle in the iakerb.c file. This allows remote attackers to cause a denial of service by sending a crafted IAKERB packet that is mishandled during a gss_inquire_context call.