CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to an integer overflow that leads to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.
K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows for a NULL pointer dereference via a DeviceIoControl request with code 0x95002574.
K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows NULL pointer dereference via a DeviceIoControl request with code 0x95002570.
In Mercurial before version 4.4.1, a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script. Typical use of Mercurial prevents the construction of such repositories, but they can be created programmatically.
Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.
Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.
Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded.
A remote code execution vulnerability exists in the Android system (bluetooth). This affects versions 7.0, 7.1.1, 7.1.2, and 8.0.
CVE-2017-13150 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of the Android system.
CVE-2017-13149 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of the Android system.
CVE-2017-0879 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of Android.
The daemon in rsync versions 3.1.2 and 3.1.3-development before 2017-12-03 does not check fnamecmp filenames in the daemon_filter_list data structure and does not apply the sanitize_paths protection mechanism to pathnames found in 'xname follows' strings. This allows remote attackers to bypass intended access restrictions.
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists during the processing of a downlink supplementary services message. This affects all Android releases using the Linux kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with the GPS location wireless interface that can lead to a Use After Free condition.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with improper validation of buffer sizes in the message passing interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS