CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element.
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-0299 and CVE-2014-0311.
Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
Microsoft Internet Explorer versions 6 through 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 6 through 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
A double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image.
The vulnerability in win32k.sys in the kernel-mode drivers of Microsoft Windows allows local users to gain elevated privileges via a crafted application.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-0305 and CVE-2014-0311.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
SQL injection vulnerability in modx.class.php in MODX Revolution versions 2.0.0 to 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Directory traversal vulnerability in users/login.php in Gnew 2013.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the gnew_language cookie.
A stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before version 4.11.02 allows remote attackers to execute arbitrary code via crafted biPlanes and biBitCount fields in a BMP file.
A vulnerability in ZTE F460 and F660 cable modems allows remote attackers to gain administrative access via sendcmd requests. This can be achieved by using 'set TelnetCfg' commands to enable a TELNET service with specified credentials.
Buffer overflow in the mpeg_read function in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
A race condition in the inet_frag_intern function in the Linux kernel through version 3.13.6 allows remote attackers to cause a use-after-free error or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with heavy CPU load.
The sctp_sf_do_5_1D_ce function in the Linux kernel through version 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call. This allows remote attackers to cause a denial of service via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.
Buffer overflow in the complete_emulated_mmio function in the Linux kernel before version 3.13.6 allows guest OS users to execute arbitrary code on the host OS. It leverages a loop that triggers an invalid memory copy affecting certain cancel_work_item data.