CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as in Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before 11.2.202.535 on Linux, allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, as well as before version 11.2.202.535 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
OpenNMS has a default password of 'rtc' for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a 'forced API token change' involving anonymous users.
J-Web in Juniper vSRX virtual firewalls with Junos OS before version 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.
In Juniper Junos OS versions before 11.4R12-S4, 12.1X44-D41, 12.1X46-D26, 12.1X47-D11/D15, 12.2R9, 12.2X50-D70, 12.3R8, 12.3X48-D10, 12.3X50-D42, 13.1R4-S3, 13.1X49-D42, 13.1X50-D30, 13.2R6, 13.2X51-D26, 13.2X52-D15, 13.3R3-S3, 14.1R3, 14.2R1, 15.1R1, and 15.1X49-D10, when configured for IPv6, remote attackers can cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.
CVE-2015-6003 is a directory traversal vulnerability in QNAP QTS before version 4.1.4 build 0910 and 4.2.x before version 4.2.0 RC2 build 0910, when AFP is enabled. It allows remote attackers to read or write to arbitrary files by leveraging access to an OS X user or guest account.
The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before version 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
ProcessFileUpload.jsp in SolarWinds Storage Manager before version 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 are vulnerable to a denial of service attack caused by a crafted GIOP packet. This leads to out-of-bounds read and listener crash.
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
The hdbsql client version 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google V8 before version 4.6.85.23, as used in Google Chrome before version 46.0.2490.71, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Adobe Flash Player w wersjach 18.x do 18.0.0.252 oraz 19.x do 19.0.0.207 na systemach Windows i OS X oraz 11.x do 11.2.202.535 na Linuksie umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany plik SWF. Ta podatność była wykorzystywana w atakach w październiku 2015 roku.
Multiple unspecified vulnerabilities in Google Chrome before version 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The CSSFontFaceSrcValue::fetch function in the CSS implementation in Blink, used in Google Chrome before version 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL. This allows remote web servers to bypass the Same Origin Policy via a redirect.