CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors.
An unspecified vulnerability in Microsoft Internet Explorer versions 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism.
A stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL.
Multiple unspecified vulnerabilities in Google V8 before version 3.24.35.33, as used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The PointerCompare function in codegen.cc in Seccomp-BPF, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.
A use-after-free vulnerability in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.
The DOM implementation in Blink, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, has an issue with improper renderer state checking upon a focus event. This can lead to denial of service or other unspecified impacts via vectors leveraging 'type confusion' for SELECT elements.
Google V8, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, improperly stores internationalization metadata. This allows remote attackers to bypass intended access restrictions by leveraging 'type confusion' and reading property values.
XCloner Standalone version 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php.
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for specific requests, such as changing the administrator password or accessing the database backup functionality.
Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.
Podatność na przejście do katalogu w NTWebServer w InduSoft Web Studio 7.1 przed SP2 Patch 4 umożliwia zdalnym atakującym odczyt administracyjnych haseł z plików APP, co może prowadzić do wykonania dowolnego kodu.
The Festo CECX-X-C1 and CECX-X-M1 Modular Controllers with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, allowing remote attackers to modify the configuration or delete log entries.
The Festo CECX-X-C1 and CECX-X-M1 Modular Controllers with CoDeSys and SoftMotion have an undocumented access method via the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause an application crash.
The server in HP Integrated Lights-Out 2 (iLO 2) version 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic.
Multiple SQL injection vulnerabilities in MODX Revolution before version 2.2.14 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit the session ID (PHPSESSID) in index.php or user parameters in connectors/security/message.php and id in manager/index.php.
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier has an issue with handling authentication requests from the remote-user auth plugin. This allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header.
Off-by-one error in the cmd_smart function in the smart self test in QEMU before version 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
In the sfpagent library before version 0.4.15 for Ruby, there is a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.