CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability.
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, as well as Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
Unspecified vulnerability in Oracle Java SE 7u51 and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, as well as Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context.
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable.
In PaperThin CommonSpot before version 7.0.2 and 8.x before version 8.0.3, there is an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a ColdFusion page.
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, allowing remote attackers to perform unspecified operations by modifying this code.
A vulnerability in PaperThin CommonSpot before version 7.0.2 and versions 8.x before 8.0.3 allows a remote attacker to bypass intended access restrictions by using a null character ('\0') in a file path on the drive containing the web root directory of a ColdFusion installation.
Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request.
The Adobe Reader Mobile application before version 11.2 for Android does not properly restrict the use of JavaScript, allowing remote attackers to execute arbitrary code via a crafted PDF document.
In Apache Xalan-Java before version 2.7.2, the TransformerFactory does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled. This allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources.
Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service by sending a malformed SSL/TLS packet, leading to a crash and restart or failover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS