CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution due to incorrect data validation. Affected appliances are SA 100, SA 400, and Virtual SA.
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Zimbra Collaboration (ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands become unescaped, causing an overwrite of arbitrary cached entries.
A remote command execution (RCE) vulnerability was discovered in D-Link DIR-820L version 1.05B03 via an HTTP POST request to the get set ccp function.
Wykryto podatność w funkcji cgroup_release_agent_write jądra Linux w pliku kernel/cgroup/cgroup-v1.c. W określonych okolicznościach, flaw ta pozwala na wykorzystanie funkcji release_agent cgroups v1 do eskalacji uprawnień oraz nieoczekiwanego obejścia izolacji przestrzeni nazw.
The Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 allows an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
Win32k Elevation of Privilege Vulnerability.
A spoofing vulnerability in AppX installer for Microsoft Windows. An attacker could craft a malicious attachment for phishing campaigns and convince the user to open it. Users with fewer user rights could be less impacted than those with administrative rights. As of December 27, 2023, Microsoft updated the installer to disable the ms-appinstaller protocol by default.
Podatność w Apache Log4j2 (w wersjach od 2.0-beta9 do 2.15.0, z wyjątkiem wydań zabezpieczeń 2.12.2, 2.12.3 i 2.3.1) pozwala atakującym na wykonanie dowolnego kodu poprzez kontrolowane przez nich wiadomości logów i parametry, gdy włączona jest substytucja wyszukiwania wiadomości. Od wersji 2.15.0 to zachowanie zostało domyślnie wyłączone, a w wersji 2.16.0 całkowicie usunięte.
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Microsoft Exchange Server Remote Code Execution Vulnerability. Details are not provided in the description, but it is a serious flaw allowing remote code execution.
Microsoft Excel Security Feature Bypass Vulnerability. Details are not provided in the description, but it allows an attacker to bypass security features.
Active Directory Domain Services Elevation of Privilege Vulnerability. Technical details are not provided in the description.
Active Directory Domain Services Elevation of Privilege Vulnerability. Technical details are not provided in the description.