CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, as well as Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code.
A use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, as well as Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X, allows attackers to execute arbitrary code.
Adobe Flash Player versions before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as Adobe AIR and its SDK versions before 19.0.0.213, improperly implement the Flash broker API, which may lead to unspecified impacts and attack vectors.
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before version 3.2.2 does not restrict access from other domains, allowing remote attackers to conduct cross-domain attacks via unspecified vectors.
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked.
The JScript and VBScript engines in Microsoft Internet Explorer 9 through 11 have a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
The VBScript 5.7 and 5.8 and JScript 5.7 and 5.8 engines in Internet Explorer 8 through 11 and other products allow remote attackers to execute arbitrary code or cause a denial of service via crafted Filter arguments, leading to memory corruption.
Microsoft Internet Explorer 10 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2015-6049.
A use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
A use-after-free vulnerability in various versions of Microsoft Excel and Excel Viewer allows remote attackers to execute arbitrary code by manipulating the fileVersion element in an Office document.
Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document.
A use-after-free vulnerability in Microsoft Excel allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document.
The kernel in Microsoft Windows 8, 8.1, Server 2012, and 10 allows local users to gain elevated privileges via a crafted application, known as 'Windows Object Reference Elevation of Privilege Vulnerability.'
The kernel in various versions of Windows mishandles junctions during mountpoint creation, allowing local users to gain elevated privileges by leveraging certain sandbox access.
The kernel in Microsoft Windows 8, 8.1, Server 2012, and 10 allows physically proximate attackers to bypass the Trusted Boot protection mechanism, potentially compromising the integrity of code and features like BitLocker and Device Encryption.
The kernel in various versions of Windows allows local users to gain elevated privileges via a crafted application, known as 'Windows Elevation of Privilege Vulnerability.'
The kernel in various versions of Windows allows local users to gain elevated privileges via a crafted application, known as 'Windows Kernel Memory Corruption Vulnerability.'