CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player before version 13.0.0.214 on Windows and OS X and before version 11.2.202.359 on Linux, as well as Adobe AIR SDK before version 13.0.0.111, allow attackers to bypass intended access restrictions via unspecified vectors.
Adobe Flash Player before version 13.0.0.214 on Windows and OS X and before version 11.2.202.359 on Linux, as well as Adobe AIR SDK before version 13.0.0.111, allow attackers to bypass intended access restrictions via unspecified vectors.
Adobe Flash Player before version 13.0.0.214 on Windows and OS X and before version 11.2.202.359 on Linux, as well as Adobe AIR SDK before version 13.0.0.111, allows attackers to bypass intended access restrictions via unspecified vectors.
Adobe Flash Player before version 13.0.0.214 on Windows and OS X and before version 11.2.202.359 on Linux, as well as Adobe AIR SDK before version 13.0.0.111, allow attackers to bypass intended access restrictions via unspecified vectors.
Adobe Flash Player before version 13.0.0.214 on Windows and OS X and before version 11.2.202.359 on Linux, as well as Adobe AIR SDK before version 13.0.0.111, allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
A stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A vulnerability in Microsoft Windows SharePoint Services and various versions of SharePoint and Project Server allows remote authenticated users to execute arbitrary code via crafted page content.
Dpkg version 1.15.9 on Debian squeeze introduces support for the 'C-style encoded filenames' feature without recognizing that the squeeze patch program lacks this feature. This leads to an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, allowing user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.
Unspecified vulnerability in OpenJDK 6 before version 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS. This vulnerability has unknown impact and attack vectors, differing from CVE-2014-0462.
The web interface 1.1 on Broadcom Ltd PIPA C211 rev2 has a vulnerability that improperly restricts access to cgi-bin/rpcBridge. This allows remote attackers to obtain credentials and other sensitive information or modify the firmware.
An integer signedness error in Android Debug Bridge (ADB) version 4.4 allows ADB servers to execute arbitrary code via a negative length value, bypassing a signed comparison and triggering a stack-based buffer overflow.
Foscam IP camera version 11.37.2.49 and others, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names. This allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server.
Unspecified vulnerability in OpenJDK 6 before version 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS may have unknown impact and attack vectors.
The drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before version 1.8.6 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various variables in functions related to request and entry management.
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, and other versions allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, allowing remote attackers to have unspecified impact via invalid XML.