CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in the Internet Explorer browser.
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability.
In DCMTK 3.6.1 and earlier, the files movescu.cc, storescp.cc, scp.cc, wlmactmg.cc, dcmprscp.cc, dcmpsrcv.cc, msgserv.cc, and dcmqrscp.cc do not check the return value of the setuid system call, allowing local users to gain privileges by creating a large number of processes.
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVE-2013-3081 is a SQL injection vulnerability in the checkEmailFormat function in Jojo.php in versions of Jojo before 1.2.2. It allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.
The Dragonfly gem versions 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct DQL injection attacks, enabling them to bypass intended restrictions on database actions.
EMC Documentum Content Server versions before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allow remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods.
EMC Documentum Content Server before version 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation and bypass intended restrictions on data access and server actions.
Funkcja futex_requeue w jądrze Linux do wersji 3.14.5 nie zapewnia, że wywołania mają dwa różne adresy futex, co pozwala lokalnym użytkownikom na uzyskanie uprawnień poprzez spreparowane polecenie FUTEX_REQUEUE, które umożliwia niebezpieczną modyfikację oczekujących.
Multiple unspecified vulnerabilities in Libav before version 0.8.12 may allow remote attackers to achieve unknown impact and vectors.
Multiple array index errors in the MyHeritage SEQueryObject ActiveX control (SearchEngineQuery.dll) version 1.0.2.0 allow remote attackers to execute arbitrary code. These issues affect various parameters of methods such as AddTokens, AddLastNameTokens, and AddMultipleSearches.
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does not properly check privileges, allowing remote attackers to gain privileges via a crafted standard universe job.
The thumbnail proxy server in EMC Documentum Digital Asset Manager (DAM) versions 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 is vulnerable to DQL injection attacks. Remote attackers can exploit a crafted parameter in a query string to bypass intended restrictions on querying objects.
OpenSSL versions before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h do not properly restrict processing of ChangeCipherSpec messages. This allows man-in-the-middle attackers to trigger the use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, potentially hijacking sessions or obtaining sensitive information.
Xen 4.4.x running on ARM systems does not properly check write permissions on virtual addresses, allowing local guest administrators to gain privileges via unspecified vectors.
The asn1_get_bit_der function in GNU Libtasn1 before version 3.6 does not properly report an error when a negative bit length is identified, allowing context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS