CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In libavcodec/xface.h in FFmpeg before version 2.5.2, there is an issue with the dimensions of certain digits and words arrays that do not satisfy a required mathematical relationship. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted X-Face image data.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string.
Juniper Junos versions before 11.4R8, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R9, 12.3R2-S3, 12.3R3, 13.1R4, and 13.2R1 are vulnerable to remote attacks that can cause denial of service through assertion failure and rpd restart via a crafted BGP FlowSpec prefix.
Juniper MX Series routers running Junos versions 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 before 14.2R2, configured as broadband edge routers, are vulnerable to remote attacks that can cause a denial of service (jpppd crash and restart) by sending a crafted PAP Authenticate-Request after the PPPoE Discovery and LCP phase are complete.
The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, allowing remote attackers to gain privileges.
GTK+ version 3.10.9 and earlier, used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
The Photo Gallery plugin version 1.2.7 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
CVE-2014-9600 in Macroplant iExplorer 3.6.3.0 features an untrusted search path vulnerability that allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse itunesmobiledevice.dll.
The vulnerability in lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMD_LQUERYLV environment-variable value.
CVE-2014-9560 is an SQL injection vulnerability in redir_last_post_list.php in SoftBB 0.1.3 that allows remote attackers to execute arbitrary SQL commands via the post parameter.
Mozilla Firefox before 35.0 on Windows allows remote attackers to bypass the Gecko Media Plugin (GMP) sandbox protection mechanism by leveraging access to the GMP process, as demonstrated by the OpenH264 plugin's process.
A use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data.
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter. This may allow remote attackers to execute arbitrary JavaScript code with chrome privileges.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 35.0 and SeaMonkey before version 2.32 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
A heap-based buffer overflow vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute arbitrary code. This affects versions before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X, and before 11.2.202.429 on Linux.
A use-after-free vulnerability in Adobe Flash Player before version 13.0.0.260 and in versions 14.x through 16.x before 16.0.0.257 on Windows and OS X, as well as before 11.2.202.429 on Linux, allows attackers to execute arbitrary code.
Adobe Flash Player and Adobe AIR in certain versions have a vulnerability that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via out-of-bounds read.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.257 (Windows, OS X) and before 11.2.202.429 (Linux) contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.260 and 16.0.0.257 on various platforms allow attackers to execute arbitrary code by leveraging an unspecified 'type confusion'.