CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon 2.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Podatność typu use-after-free w klasie BitmapData w implementacji ActionScript 3 w Adobe Flash Player umożliwia zdalnym atakującym wykonanie dowolnego kodu lub spowodowanie awarii usługi poprzez złośliwe treści Flash, które nadpisują funkcję valueOf. Problem dotyczy wersji Flash Player od 13.x do 18.0.0.204 na różnych systemach operacyjnych.
Podatność typu use-after-free w klasie DisplayObject w implementacji ActionScript 3 w Adobe Flash Player umożliwia zdalnym atakującym wykonanie dowolnego kodu lub spowodowanie odmowy usługi poprzez złośliwe treści Flash. Problem dotyczy wersji Flash Player na różne systemy operacyjne, w tym Windows, OS X i Linux.
The REST API in IBM Business Process Manager (BPM) allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.
EMC RecoverPoint for Virtual Machines (VMs) version 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
The vmware-vmx.exe in VMware Workstation and VMware Player has a vulnerability that allows host OS users to gain host privileges by injecting a thread. This issue affects versions prior to 10.0.7 and 11.1.1 for Workstation and prior to 6.0.7 and 7.1.1 for Player.
The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for storage of these commands in a Compact Flash (CF) file.
A heap-based buffer overflow in Adobe Flash Player allows for arbitrary code execution. This affects versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux.
A use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux, and in Adobe AIR before 18.0.0.180, allows attackers to execute arbitrary code.
Adobe Flash Player and Adobe AIR prior to specified versions contain a vulnerability that allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
A heap-based buffer overflow exists in Adobe Flash Player that can lead to arbitrary code execution. This affects versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux.
Adobe Flash Player and Adobe AIR in specific versions allow attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This affects versions before 13.0.0.302 for Flash Player and before 18.0.0.180 for Adobe AIR.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux. It also affects Adobe AIR before version 18.0.0.180 and Adobe AIR SDK and Compiler before the same version, allowing attackers to execute arbitrary code.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors.
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors. This is a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4430, and CVE-2015-5117.
A use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.302 and in versions 14.x through 18.x before 18.0.0.203 on Windows and OS X, as well as before 11.2.202.481 on Linux. It also affects Adobe AIR and its SDK before version 18.0.0.180, allowing attackers to execute arbitrary code.
A heap-based buffer overflow exists in Adobe Flash Player that can lead to arbitrary code execution. This affects versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux, as well as Adobe AIR and its SDK before version 18.0.0.180, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.