CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, allowing local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges.
Multiple unspecified vulnerabilities in HP ArcSight Enterprise Security Manager (ESM) before version 6.8c may lead to unknown impact and allow remote attacks.
Multiple unspecified vulnerabilities in HP ArcSight Logger before version 6.0P1 may lead to unknown impact and allow remote authenticated attacks.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.277 and 14.x through 17.x before version 17.0.0.134 on Windows and OS X and before version 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Flash Player before version 13.0.0.277 and in versions 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Integer overflow in Adobe Flash Player before version 13.0.0.277 and 14.x through 17.x before version 17.0.0.134 on Windows and OS X and before version 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
A race condition in the TLS implementation in the management interface of Cisco Intrusion Prevention System (IPS) Software before version 7.3(3)E4 allows remote attackers to cause a denial of service by establishing many HTTPS sessions.
The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before versions X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before versions X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters.
The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service via a crafted media description.
Multiple SQL injection vulnerabilities in Betster (PHP Betoffice) version 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter in showprofile.php, categoryedit.php, and the username parameter during login to index.php.
The logrotation script in the Upstart package in Ubuntu before version 1.13.2-0ubuntu9 allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.
The x86 emulator in Xen versions 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands. This allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code.
Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.