CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HPE Operations Orchestration versions 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.
HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.
The compile_branch function in PCRE 8.x before 8.39 and in PCRE2 before 10.22 mishandles patterns containing the (*ACCEPT) substring in conjunction with nested parentheses. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted regular expression.
A stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.
HPE Network Automation versions 9.22 through 9.22.02 and 10.x before 10.00.02 allow remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors.
HPE Network Automation versions 9.22 through 9.22.02 and 10.x before 10.00.02 allow remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors.
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The MPEG4Source::fragmentedRead function in libstagefright in Android before version 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before March 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The portal client in IBM Tivoli Monitoring (ITM) versions 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified vectors.
Buffer overflow in the web server on Cisco DPC2203 and EPC2203 devices with firmware r1_customer_image allows remote attackers to execute arbitrary code via a crafted HTTP request.
Adobe Reader and Acrobat before version 11.0.15, and Acrobat and Acrobat Reader DC Classic before version 15.006.30121, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20060 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.15, and Acrobat and Acrobat Reader DC Classic before version 15.006.30121, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20060 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Microsoft .NET Framework versions 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandle signature validation for unspecified elements of XML documents, allowing remote attackers to spoof signatures via a modified document.
Multiple unspecified vulnerabilities in Google V8 before version 4.9.385.26, as used in Google Chrome before version 49.0.2623.75, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 49.0.2623.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A use-after-free vulnerability in the WebRTC Audio Private API implementation in Google Chrome before version 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect reliance on the resource context pointer.