CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Fonality (previously trixbox Pro) versions 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, allowing remote attackers to gain access via FTP or SSH connection.
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact.
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions. This can be achieved by leveraging access to a different account with the same role as a target account or an account's session at an unattended workstation.
The printfDx function in Takumi Yamada DX Library for Borland C++ versions 3.13f through 3.16b, Gnu C++ versions 3.13f through 3.16b, and Visual C++ versions 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.
The web-based management interface on Cisco RV110W, RV130W, and RV215W devices with outdated firmware allows remote attackers to execute arbitrary code as root via a crafted HTTP request.
The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a link-local source address.
Nieokreślona podatność w Adobe Flash Player 21.0.0.242 i wcześniejszych wersjach umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieznane wektory. Wykorzystano ją w praktyce w czerwcu 2016 roku.
Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The extension manager in Adobe Brackets before version 1.7 allows attackers to have an unspecified impact via invalid input.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.352 and 19.x through 21.x before version 21.0.0.242 on Windows and OS X and before version 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The WPAD protocol implementation in Windows has issues with proxy discovery, allowing remote attackers to redirect network traffic.
A use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests.
A stack-based buffer overflow in Huawei Honor WS851 routers with software version 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges.