CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via various commands such as auth, add, or runAsync.
Samsung iPOLiS Device Manager before version 1.8.7 allows remote attackers to execute arbitrary code via unspecified values in methods such as Start, ChangeControlLocalName, DeleteDeviceProfile, or FrameAdvanceReader in the ActiveX control.
The Dispatch_Write function in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, leading to an out-of-bounds write.
Multiple integer signedness errors in the Dispatch_Write function in DirectFB 1.4.13 may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, leading to a stack-based buffer overflow.
A stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.
A heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in Google Chrome before version 35.0.1916.153 allows remote attackers to exploit small VideoFrame data structures. This can lead to denial of service or potentially other unspecified impacts.
Buffer overflow in the clipboard implementation in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data.
A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before version 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.
A use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before version 30.0, Firefox ESR 24.x before version 24.6, and Thunderbird before version 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
A use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
A use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
A use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
The PropertyProvider::FindJustificationRange function in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 30.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux, as well as Adobe AIR SDK before 14.0.0.110, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux have a vulnerability that allows attackers to bypass intended access restrictions. This is a different vulnerability than CVE-2014-0534.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux, as well as Adobe AIR SDK before 14.0.0.110, allow attackers to bypass intended access restrictions via unspecified vectors.