CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) before version 8.1.4 does not properly implement access control, allowing remote authenticated users to modify administrative credentials via a crafted URL.
CVE-2014-0602 describes a vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through version 6.5.4, allowing remote attackers to execute arbitrary code.
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via manipulation of the value property.
LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.
A use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects.
Multiple integer overflows in the lzo1x_decompress_safe function in the LZO decompressor in the Linux kernel before version 3.15.2 may allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.
The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, consequently gaining privileges by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and executing a setuid program.
A heap-based buffer overflow in paintlib, used in Trimble SketchUp before version 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap.
Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write.
Timbre SketchUp before version 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, leading to a stack-based buffer overflow.
Thunderbolt in Apple OS X before version 10.9.4 does not properly restrict IOThunderBoltController API calls, allowing attackers to execute arbitrary code or cause a denial of service via a crafted call.
Graphics Drivers in Apple OS X before 10.9.4 allow attackers to gain privileges or cause a denial of service via a 32-bit executable file for a crafted application.
Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.
Apple OS X versions before 10.9.4 have a security vulnerability that improperly restricts OpenCL API calls. This allows attackers to execute arbitrary code via a crafted application.
The Intel Graphics Driver in Apple OS X before version 10.9.4 does not properly restrict an unspecified OpenGL API call, allowing attackers to execute arbitrary code via a crafted application.
Array index error in Dock in Apple OS X before version 10.9.4 allows attackers to execute arbitrary code or cause a denial of service through incorrect function-pointer dereference, leading to application crashes.
An integer underflow in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
A heap-based buffer overflow in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that generates log messages.
A heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that sends IPC messages.