CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.
Android versions before 4.4 do not properly manage the seeding of the OpenSSL PRNG, making it easier for attackers to defeat cryptographic protection mechanisms by leveraging the PRNG within multiple applications.
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted request.
Simple Machines Forum (SMF) versions 2.0.6, 1.1.19, and earlier allow remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters.
Juvia uses the same secret key for all installations, allowing remote attackers to leverage the secret key in app/config/initializers/secret_token.rb, which may lead to unspecified impact on cookies.
Buffer overflow in Adobe Flash Player before version 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CookieInterceptor in Apache Struts before version 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, allowing remote attackers to 'manipulate' the ClassLoader and execute arbitrary code via a crafted request.
ParametersInterceptor in Apache Struts before version 2.3.20 does not properly restrict access to the getClass method, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request.
Unitrends Enterprise Backup version 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.
CVE-2014-2846 describes a directory traversal vulnerability in the index.php file of the WD Arkeia virtual appliance. This allows remote attackers to read arbitrary files and execute arbitrary PHP code by manipulating the lang Cookie parameter.
An unspecified vulnerability in the print release functionality in PaperCut MF before version 14.1 (Build 26983) may lead to unknown impact and remote attack vectors, related to embedded MFPs.
Livetecs Timelive before version 6.5.1 has an unrestricted file upload vulnerability in the Manage Project functionality. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and accessing it via a direct request.
Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, allowing remote attackers to change configurations and obtain the database connection string and credentials.
The openvswitch-agent process in OpenStack Neutron versions 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
The Python Image Library (PIL) version 1.1.7 and earlier and Pillow version 2.3 may allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly in JpegImagePlugin.py.
Podatność typu use-after-free w Microsoft Internet Explorer od wersji 6 do 11 umożliwia zdalnym atakującym wykonanie dowolnego kodu lub spowodowanie odmowy usługi (uszkodzenie pamięci) poprzez wektory związane z funkcją CMarkup::IsConnectedToPrimaryMarkup. Problem ten był wykorzystywany w atakach w kwietniu 2014 roku.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 6 through 11 allow remote attackers to execute arbitrary code via unspecified vectors.
Microsoft Internet Explorer versions 7 through 11 allow remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging 'object confusion' in a broker process.