CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a link-local source address.
Nieokreślona podatność w Adobe Flash Player 21.0.0.242 i wcześniejszych wersjach umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieznane wektory. Wykorzystano ją w praktyce w czerwcu 2016 roku.
Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The extension manager in Adobe Brackets before version 1.7 allows attackers to have an unspecified impact via invalid input.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge.
Use-after-free vulnerability in Adobe Flash Player before version 18.0.0.352 and 19.x through 21.x before version 21.0.0.242 on Windows and OS X and before version 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The WPAD protocol implementation in Windows has issues with proxy discovery, allowing remote attackers to redirect network traffic.
A use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests.
A stack-based buffer overflow in Huawei Honor WS851 routers with software version 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges.
OCaml before 4.03.0 does not properly handle sign extensions, allowing remote attackers to conduct buffer overflow attacks or obtain sensitive information, as demonstrated by a long string to the String.copy function.
Citrix XenServer 7.0 before Hotfix XS70E003, when upgraded from an earlier release, may allow remote attackers on the management network to 'compromise' a host by leveraging credentials for an Active Directory account.
The Framework UI permission-dialog implementation in Android 6.x before June 1, 2016, allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window.
The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
The OpenBlob function in GraphicsMagick before version 1.3.24 and in ImageMagick allows remote attackers to execute arbitrary code by placing a | (pipe) character at the start of a filename.
The XXE (XML External Entity) vulnerability in XmlMapper in the Data format extension for Jackson (jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.