CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site.
A use-after-free vulnerability in Windows Shell in various versions of Microsoft Windows allows remote attackers to execute arbitrary code via a crafted toolbar object.
The VBScript 5.7 and 5.8 and JScript 5.7 and 5.8 engines in Internet Explorer 8 through 11 and other Microsoft products allow remote attackers to execute arbitrary code or cause a denial of service via a crafted replace operation with a JavaScript regular expression.
Cisco Aironet 1850 access points with software 8.1(112.4) allow local users to gain privileges via crafted CLI commands.
The RSS Reader component in Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.
Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 allow remote authenticated users to execute arbitrary PHP code via unspecified vectors.
The JMX RMI service in VMware vCenter Server in versions 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, allowing remote attackers to execute arbitrary code via the RMI protocol.
EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
The object-observe.js file in Google V8, used in Google Chrome before version 45.0.2454.101, does not properly restrict method calls on access-checked objects. This allows remote attackers to bypass the Same Origin Policy via observe or getNotifier calls.
In Blink, used in Google Chrome before version 45.0.2454.101, there is a vulnerability that does not perform a rethrow action to propagate information about cross-context exceptions. This allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.
Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long USER command.
In ZOHO ManageEngine OpManager versions 11.6, 11.5, and earlier, remote administrators can bypass SQL query restrictions by adding a comment in the query to api/json/admin/SubmitQuery, as demonstrated by 'INSERT/**/INTO'.
ZOHO ManageEngine OpManager version 11.5 build 11600 and earlier uses a hardcoded password 'plugin' for the IntegrationUser account, allowing remote authenticated users to gain administrator access by leveraging knowledge of this password.
Unspecified vulnerability in International Components for Unicode (ICU) before version 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2.
GasGauge in Apple watchOS before version 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
GasGauge in Apple watchOS before version 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value, allowing attackers to cause a denial of service (boot failure) via a crafted app that writes to an unintended address.
The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.