CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before version 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.
A use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before version 30.0, Firefox ESR 24.x before version 24.6, and Thunderbird before version 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
A use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
A use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
A use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
The PropertyProvider::FindJustificationRange function in Mozilla Firefox before version 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 30.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux, as well as Adobe AIR SDK before 14.0.0.110, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux have a vulnerability that allows attackers to bypass intended access restrictions. This is a different vulnerability than CVE-2014-0534.
Adobe Flash Player and Adobe AIR versions before 13.0.0.223 and 14.0.0.125 on Windows and OS X, and before 11.2.202.378 on Linux, as well as Adobe AIR SDK before 14.0.0.110, allow attackers to bypass intended access restrictions via unspecified vectors.
Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 have a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded font in a .doc or .docx document.
Microsoft Internet Explorer versions 8 through 11 allow remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, known as 'Internet Explorer Elevation of Privilege Vulnerability.'
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
Microsoft Internet Explorer versions 6 through 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2014-2768.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in Internet Explorer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS