CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in rsh in the remote_cmds component in Apple OS X before version 10.11 allows local users to gain root privileges through manipulation of environment variables.
The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, allowing remote attackers to have an unspecified impact via crafted TLS data.
The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOHIDFamily in Apple OS X before 10.11 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, allowing physically proximate attackers to access an unattended workstation.
The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
The Safari Extensions implementation in Apple Safari before version 9 does not require user confirmation before replacing an installed extension, which may lead to unspecified impacts and attack vectors.
Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 mishandle authentication requests, allowing remote authenticated users to conduct LDAP injection attacks. This can lead to bypassing intended login restrictions or obtaining sensitive information by leveraging certain group-administration privileges.
In Android 5.x before version 5.1.1 LMY48T and 6.0 before October 1, 2015, the mediaserver component allows attackers to gain privileges via a crafted application.
libstagefright in Android 5.x before 5.1.1 LMY48T has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, allowing local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
The Secure Element Evaluation Kit (SEEK or SmartCard API) plugin in Android before version 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, potentially leading to Signature or SignatureOrSystem access.
libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The vulnerability in libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The vulnerability in libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.