CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center and other tools expose functionality to read/write data from/to IO ports. This could be leveraged to run code with elevated privileges.
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center and other tools expose functionality to read and write arbitrary physical memory. A local attacker could leverage this to elevate privileges.
The GDrv low-level driver in GIGABYTE APP Center and other tools exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. Affects multiple Windows versions including Windows 7, Windows 10, and Windows Server.
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
A vulnerability in the web interface of Cisco ASA could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. In certain releases, directory traversal could also allow unauthenticated disclosure of sensitive system information. The issue is due to lack of proper input validation of the HTTP URL.
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability.' This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability.' This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to improper neutralization of special elements in the property binder. An unauthenticated remote attacker can supply specially crafted request parameters against Spring Data REST backed HTTP resources or use Spring Data's projection-based request payload binding, leading to remote code execution.
A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.
Podatność w komponencie Oracle WebLogic Server w Oracle Fusion Middleware umożliwia nieautoryzowanemu atakującemu z dostępem do sieci przez T3 przejęcie serwera. Dotknięte wersje to 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 oraz 12.2.1.2.0.
W serwerze aplikacji Jboss, dostarczanym z Red Hat Enterprise Application Platform 5.2, stwierdzono, że metoda doFilter w ReadOnlyAccessFilter HTTP Invoker nie ogranicza klas, dla których wykonuje deserializację. To pozwala atakującemu na wykonanie dowolnego kodu za pomocą spreparowanych danych serializowanych.
Podatność w Apache Tomcat 7.0.0 do 7.0.79 na systemie Windows umożliwia przesyłanie plików JSP na serwer poprzez specjalnie skonstruowane żądanie, gdy HTTP PUT jest włączone. Po przesłaniu, plik JSP może być wywołany, co prowadzi do wykonania zawartego w nim kodu przez serwer.
Progress Telerik UI dla ASP.NET AJAX przed R2 2017 SP2 nie ogranicza poprawnie wejścia użytkownika w RadAsyncUpload, co pozwala zdalnym atakującym na przesyłanie dowolnych plików lub wykonywanie dowolnego kodu.
Sterownik diagnostyczny Intel Ethernet dla systemu Windows w wersjach przed 1.3.1.0 zawiera podatność, która pozwala lokalnym użytkownikom na wywołanie odmowy usługi lub potencjalne wykonanie dowolnego kodu z uprawnieniami jądra poprzez spreparowane wywołania IOCTL.
Odkryto podatność na wstrzykiwanie poleceń w routerze Zyxel EMG2926 z oprogramowaniem V1.00(AAQT.4)b8. Podatność ta znajduje się w narzędziach diagnostycznych, szczególnie w funkcji nslookup, co pozwala na wykonanie dowolnych poleceń na routerze przez złośliwego użytkownika.