CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4. It allows remote attackers to execute arbitrary code or cause a denial of service via an aria-owns attribute.
A use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via mishandled Unicode characters during text conversion.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.
Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code.
A use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before version 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administrative access by leveraging knowledge of these passwords.
The SMB service in EMC VNXe (including VNXe3200 prior to version 3.1.5.8711957 and VNXe3100/3150/3300 prior to version 2.4.4.22638) and VNX1 and VNX2 File OE before specified versions does not prevent duplicate NTLM challenge-response nonces, making it easier for remote attackers to execute arbitrary code or read/write files.
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 rely on client-side authentication, allowing remote attackers to spoof clients and read backup data via a modified client agent.
Oracle MySQL versions up to 5.5.52, 5.6.x up to 5.6.33, and 5.7.x up to 5.7.15, as well as MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17, and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7, allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file in the my.cnf file.
CVE-2016-6536 affects AVer Information EH6108H+ devices with firmware X9.03.24.00.07l, where remote attackers can bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, allowing remote attackers to gain root access by leveraging knowledge of the credentials and establishing a TELNET session.
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10 has a default password for compilation VMs, allowing remote attackers to gain SSH access.
EMC ViPR SRM versions before 3.7.2 do not restrict the number of password-authentication attempts, making it easier for remote attackers to gain access via a brute-force guessing attack.
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when using vCloud or vSphere, does not properly enable SSH access for operators, which may lead to unspecified impacts.