CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow exists in the 'Add from text file' feature of the DameWare Exporter tool. This allows user-assisted attackers to execute arbitrary code.
In versions of Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, there is a vulnerability that does not validate the length of the destination array before a copy operation. This allows remote attackers to execute arbitrary code or cause a denial of service through incorrect use of the TypedArrayObject class.
In versions of Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, there is a vulnerability that does not prevent a zero-length transition during the use of an ArrayBuffer object. This allows remote attackers to execute arbitrary code or cause a denial of service.
A use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption during garbage collection.
Mozilla Firefox versions before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
The gfxContext::Polygon function in libxul.so in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.
The CVE-2014-1507 vulnerability in the DeviceStorage API in Mozilla FirefoxOS before version 1.2.2 allows attackers to bypass the media sandbox protection mechanism, enabling them to read or modify arbitrary files via a crafted application.
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information and possibly bypass the Same Origin Policy to read text from a different domain via a timing attack involving feDisplacementMap elements.
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
A memory leak in the TCP stack in the kernel in Sophos UTM before version 9.109 allows remote attackers to cause a denial of service through unspecified vectors.
A stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.
SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before version 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
The x_button method in the ServiceController in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, triggering a heap-based buffer overflow.
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
A vulnerability in /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain elevated privileges by providing an arbitrary program name as a command-line argument.