CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Integer overflow in Adobe Reader and Acrobat before 11.0.16, and in Acrobat and Acrobat Reader DC Classic before 15.006.30172, as well as in Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to bypass JavaScript API execution restrictions via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Flash Player w wersji 21.0.0.226 i wcześniejszych umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieokreślone wektory. Wykorzystanie tej podatności miało miejsce w maju 2016 roku.
Adobe ColdFusion versions 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler before version 6.2.3 allow remote attackers to execute arbitrary SQL commands.
In libFLAC/stream_decoder.c in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, free operations on uninitialized memory are not prevented, allowing remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted media file.
In libAACdec in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and before May 1, 2016, the number of threads is not properly limited, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
CVE-2016-2351 describes an SQL injection vulnerability in the home/seos/courier/security_key2.api file on the Accellion File Transfer Appliance (FTA) before version FTA_9_12_40. This allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
The management-services protocol implementation in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
The bpcd in Veritas NetBackup versions 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2, as well as in NetBackup Appliance versions 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2, allows remote attackers to execute arbitrary commands via crafted input.
A double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS