CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player w wersji 21.0.0.226 i wcześniejszych umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieokreślone wektory. Wykorzystanie tej podatności miało miejsce w maju 2016 roku.
Adobe ColdFusion versions 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler before version 6.2.3 allow remote attackers to execute arbitrary SQL commands.
In libFLAC/stream_decoder.c in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, free operations on uninitialized memory are not prevented, allowing remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted media file.
In libAACdec in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and before May 1, 2016, the number of threads is not properly limited, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
CVE-2016-2351 describes an SQL injection vulnerability in the home/seos/courier/security_key2.api file on the Accellion File Transfer Appliance (FTA) before version FTA_9_12_40. This allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
The management-services protocol implementation in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
The bpcd in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2, allows remote attackers to execute arbitrary commands via crafted input.
A double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
The XML API in Cisco TelePresence Software mishandles authentication, allowing remote attackers to execute control commands or make configuration changes via an API request.
SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the 'negative zero' issue.
The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.