CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before version 1.60 IR 04 stores rde.jar under the web root with insufficient access control, allowing remote attackers to obtain sensitive configuration information.
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, allowing remote attackers to obtain database credentials via the install parameter with the value 4.
An off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, leading to a heap-based buffer overflow.
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus, potentially executing arbitrary code with root privileges.
Nieokreślona podatność w Adobe Flash Player do wersji 13.0.0.262 oraz 14.x, 15.x i 16.x do wersji 16.0.0.287 na systemach Windows i OS X oraz do wersji 11.2.202.438 na Linuxie, która umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieznane wektory. Wykorzystano ją w praktyce w styczniu 2015 roku.
Adobe Flash Player w wersjach przed 13.0.0.262 oraz 14.x do 16.x przed 16.0.0.287 na systemach Windows i OS X oraz przed 11.2.202.438 na Linuksie nie ogranicza prawidłowo odkrywania adresów pamięci. To umożliwia atakującym obejście mechanizmu ochrony ASLR na Windows oraz może mieć nieokreślony wpływ na inne platformy.
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5. Remote attackers can inject arbitrary web script or HTML via the status parameter in a search action.
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.91 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The Fonts implementation in Google Chrome before version 40.0.2214.91 does not initialize memory for a data structure, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The collator implementation in International Components for Unicode (ICU) version 52 through SVN revision 293126, used in Google Chrome before version 40.0.2214.91, does not initialize memory for a data structure. This may allow remote attackers to cause a denial of service or potentially have unspecified other impact via a crafted character sequence.
The Fonts implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2 allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.
A use-after-free vulnerability in the Speech implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.
Use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.
Use-after-free vulnerability in the matroska_read_seek function in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.
Use-after-free vulnerability in the Element::detach function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving pending updates of detached elements.
The factory.cc file in Google V8, used in Google Chrome before version 40.0.2214.91, contains a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or potentially unspecified other impact via crafted JavaScript code that triggers improper maintenance of backing-store pointers.
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.