CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Flash Player and Adobe AIR versions before 13.0.0.244 and 15.0.0.152 on Windows and OS X, and before 11.2.202.406 on Linux, as well as Adobe AIR SDK before 15.0.0.249, allow attackers to execute arbitrary code or cause a denial of service through unspecified vectors. This is a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0555.
Adobe Flash Player and Adobe AIR in specific versions contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Adobe Flash Player and Adobe AIR in specific versions on various operating systems contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through unspecified vectors. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Adobe Flash Player and Adobe AIR in specific versions across various platforms have a vulnerability that allows attackers to execute arbitrary code or cause a denial of service through memory corruption.
Adobe Flash Player and Adobe AIR in certain versions allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
Adobe Flash Player and Adobe AIR in specific versions are vulnerable to arbitrary code execution or denial of service due to memory corruption. The issue affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR.
Heap-based buffer overflow in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to 'unbalanced quotes.'
The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
SolarWinds Log and Event Manager before 6.0 uses 'static' credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
An unspecified vulnerability in the Authentication Module in TIBCO Spotfire Server before 4.5.2, 5.0.x before 5.0.3, 5.5.x before 5.5.2, 6.0.x before 6.0.3, and 6.5.x before 6.5.1 allows remote attackers to gain privileges and access sensitive information or modify data.
Cisco IOS XR 4.3(.2) and earlier, used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service by sending a malformed IPv6 packet.
IBM DB2 has a stack-based buffer overflow affecting versions 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows. This allows remote authenticated users to execute arbitrary code via a crafted ALTER MODULE statement.
A use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
A use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1. It allows remote attackers to execute arbitrary code or cause a denial of service via an SVG animation with DOM interaction that triggers incorrect cycle collection.
Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 32.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, allowing remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.
S3QL version 1.18.1 and earlier uses the pickle Python module unsafely, allowing remote attackers to execute arbitrary code via a crafted serialized object in common.py or local.py in the backends/ directory.