CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Remote code execution vulnerability in Microsoft Outlook. Allows an attacker to execute code remotely on the victim's machine.
Security feature bypass vulnerability in Internet Shortcut Files. Allows an attacker to bypass system security features.
A security feature bypass vulnerability in Windows SmartScreen.
Elevation of privilege vulnerability in the Windows kernel, allowing an attacker to gain higher privileges on the system.
An out-of-bounds write in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests. Affects multiple versions of FortiOS and FortiProxy.
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. It allows an attacker to access certain restricted resources without authentication.
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, leading to a double free in nf_hook_slow().
A command injection vulnerability in web components of Ivanti Connect Secure and Ivanti Policy Secure. It allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure. It allows a remote attacker to access restricted resources by bypassing control checks.
It was discovered that an nft object or expression could reference an nft set in a different nft table, leading to a use-after-free once that table was deleted.
Path traversal vulnerability in SysAid On-Premise before 23.3.36, allowing file write to Tomcat webroot leading to code execution. Exploited in the wild in November 2023.
Sensitive information disclosure vulnerability in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
The HTTP/2 protocol allows a denial of service (server resource consumption) due to the ability to quickly reset many streams through request cancellation. This attack has been exploited in the wild from August to October 2023.
A vulnerability in the remote access VPN feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack to identify valid credentials or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. The issue is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features.
A path traversal vulnerability was found in Qlik Sense Enterprise for Windows in versions up to May 2023 Patch 3, February 2023 Patch 7, November 2022 Patch 10, and August 2022 Patch 12. This allows an unauthenticated remote attacker to generate an anonymous session and transmit HTTP requests to unauthorized endpoints.
An HTTP Request Tunneling vulnerability was found in Qlik Sense Enterprise for Windows affecting versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier. This allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request.
KNX devices using KNX Connection Authorization and supporting Option 1 can be locked, preventing users from resetting them to regain access. An attacker with network or physical access can set a BCU key, locking the device.
WinRAR versions before 6.23 allow attackers to execute arbitrary code when a user attempts to open a benign file within a ZIP archive. The issue occurs when the ZIP archive contains a benign file (such as a regular .JPG file) and a folder with the same name, and the contents of the folder (which may include executable content) are processed when trying to access only the benign file.
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.