CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The administrative web interface in Cisco WebEx Meetings Server versions 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields.
Multiple SQL injection vulnerabilities in FancyFon FAMOC before version 3.17.4 allow remote attackers to execute arbitrary SQL commands via the device ID REST parameter or remote authenticated users via the order parameter.
SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Multiple SQL injection vulnerabilities in Translations in Fork CMS before version 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.
In ZeroCMS versions 1.3.3, 1.3.2, and earlier, there is an SQL injection vulnerability in views/zero_transact_user.php in the administrative backend. This allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action.
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before version 14.2.0.253 allows local users to write to arbitrary memory locations, potentially gaining privileges.
bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before version 15.0.288 allows local users to write data to arbitrary memory locations, potentially leading to privilege escalation.
The tmeext.sys driver in Trend Micro Antivirus Plus, Internet Security, and Maximum Security before version 2.0.0.1015 allows local users to write to arbitrary memory locations, potentially gaining privileges.
The TDI driver (avgtdix.sys) in AVG Internet Security before version 2013.3495 Hot Fix 18 and 2015.x before version 2015.5315 allows local users to write to arbitrary memory locations, potentially gaining elevated privileges via a crafted 0x830020f8 IOCTL call.
Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The OriginCanAccessServiceWorkers function in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android does not properly restrict the URI scheme during ServiceWorker registration, allowing remote attackers to gain privileges via a filesystem: URI.
A use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
NetApp OnCommand Balance before 4.2P2 contains a default privileged account, allowing remote attackers to gain privileges via unspecified vectors.
Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before version 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.
CVE-2014-0604 is a vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before version 14.1.429, allowing remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before version 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, leading to dereferencing an arbitrary memory address.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors.
A heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.