CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors.
The statem/statem.c file in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, allowing remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.
Use-after-free vulnerability in Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code via unspecified vectors. This is a different vulnerability than CVE-2016-4263.
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), as well as Murano-dashboard and python-muranoclient, improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files. This allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions.
The parse_string function in the cJSON library mishandles UTF8/16 strings, allowing remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, triggering a heap-based buffer overflow.
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
In Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, a vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 does not protect applications from untrusted CGI client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.
The xpointer.c file in libxml2 before version 2.9.5 does not forbid namespace nodes in XPointer ranges, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted XML document.
DEXIS Imaging Suite 10 has a hardcoded password for the sa account, allowing remote attackers to gain administrative access by entering this password in a DEXIS_DATA SQL Server session.
Open Dental 16.1 and earlier has a hardcoded MySQL root password, allowing remote attackers to gain administrative access by leveraging access to intranet TCP port 3306.
On Cisco IronPort AsyncOS devices in versions 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125, when Enrollment Client before 1.0.2-065 is installed, remote attackers can obtain root access via a connection to the testing/debugging interface.
Cisco Cloud Services Platform (CSP) 2100 version 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request.
A use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before 45.4, and Thunderbird before 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
A use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4. It allows remote attackers to execute arbitrary code or cause a denial of service via an aria-owns attribute.
A use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via mishandled Unicode characters during text conversion.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.