CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer 7 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website, known as 'Internet Explorer Memory Corruption Vulnerability.'
A vulnerability in Windows systems allows attackers to bypass access restrictions by leveraging low-integrity processes to launch the On-Screen Keyboard and upload a crafted application.
Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted Journal (.JNT) file.
A double free vulnerability in the Ancillary Function Driver (AFD) in Windows allows local users to gain elevated privileges via a crafted application.
ScriptHelperApi in the AVG ScriptHelper ActiveX control in ScriptHelper.exe in AVG Secure Search toolbar before version 18.1.7.598 and AVG Safeguard before version 18.1.7.644 does not implement domain-based access control for method calls, allowing remote attackers to trigger the downloading and execution of arbitrary programs via a crafted web site.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not restrict object types, allowing remote authenticated users to run save RPC commands with super-user privileges and execute arbitrary code.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after the creation of an object, allowing remote authenticated users to execute arbitrary code with super-user privileges via a custom script.
SQL injection vulnerability in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
CVE-2014-3482 is an SQL injection vulnerability in the PostgreSQL adapter for Active Record in Ruby on Rails versions 2.x and 3.x before 3.2.19. It allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) before version 10 does not properly implement access control, allowing remote attackers to modify user information via a crafted URL.
Multiple buffer overflows in RealNetworks RealPlayer before version 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed elst or stsz atom in an MP4 file.
NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password 'debugpassword' for the ntgruser account, allowing remote attackers to upload firmware or read and modify memory contents, consequently executing arbitrary code.
Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.
Unspecified vulnerability in HP Universal CMDB versions 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP Universal CMDB versions 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP Universal CMDB versions 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Unspecified vulnerability in HP SiteScope versions 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via unknown vectors.
Cisco Unified Communications Domain Manager (CDM) in versions before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to gain access to support and root accounts by extracting this key from a binary file found in a different installation of the product.