CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Admin portal in Cisco Identity Services Engine (ISE) versions 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors.
Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before 11.0.14, and Acrobat and Acrobat Reader DC Classic before 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.14, and Acrobat and Acrobat Reader DC Classic before 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code.
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka 'Microsoft Edge Memory Corruption Vulnerability.'
Versions of BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem. This may allow remote attackers to gain access to AOM via an (1) expired or (2) default password.
Integer overflow in the ImageRegionReader::ReadIntoBuffer function in Grassroots DICOM before version 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, triggering a buffer overflow.
Idle stream handling in nghttp2 before version 1.6.0 contains a heap-use-after-free bug that can be exploited by attackers in unspecified ways.
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
A heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before version 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Advantech EKI-132x devices with firmware before December 31, 2015, allow remote attackers to bypass authentication via unspecified vectors.
The initialize method in the Histogram class in the colorscore gem before version 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the image_path, colors, or depth variable.
Buffer overflow in the pcnet_receive function in QEMU when a guest NIC has a larger MTU allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
The FontManager._get_nix_font_path function in Pygments versions 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, allowing remote administrators with the 'Import value sets' permission to execute arbitrary PHP code via the exported values list in a ctools import.
SAP Afaria version 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to 'Insecure signature.'