CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
A use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to execute arbitrary code or cause a denial of service through improper handling of an imgLoader object during an image-resize operation.
The Web Notification API in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to bypass source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page.
The sse2_composite_src_x888_8888 function in the Pixman library, used in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause application crashes by painting on a CANVAS element.
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted VIDEO element in an HTML document.
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service via crafted content.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.
Android versions before 4.4 do not properly manage the seeding of the OpenSSL PRNG, making it easier for attackers to defeat cryptographic protection mechanisms by leveraging the PRNG within multiple applications.
The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted request.
Simple Machines Forum (SMF) versions 2.0.6, 1.1.19, and earlier allow remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters.
Juvia uses the same secret key for all installations, allowing remote attackers to leverage the secret key in app/config/initializers/secret_token.rb, which may lead to unspecified impact on cookies.
Buffer overflow in Adobe Flash Player before version 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CookieInterceptor in Apache Struts before version 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, allowing remote attackers to 'manipulate' the ClassLoader and execute arbitrary code via a crafted request.
ParametersInterceptor in Apache Struts before version 2.3.20 does not properly restrict access to the getClass method, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request.
Unitrends Enterprise Backup version 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.
CVE-2014-2846 describes a directory traversal vulnerability in the index.php file of the WD Arkeia virtual appliance. This allows remote attackers to read arbitrary files and execute arbitrary PHP code by manipulating the lang Cookie parameter.
An unspecified vulnerability in the print release functionality in PaperCut MF before version 14.1 (Build 26983) may lead to unknown impact and remote attack vectors, related to embedded MFPs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS