CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer overflow or wraparound vulnerability has been discovered in Microsoft Defender. This flaw allows an unauthorized attacker to execute code locally.
An integer underflow (wrap or wraparound) vulnerability in Microsoft Defender allows an unauthorized attacker to execute code locally.
A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
A heap-based buffer overflow vulnerability in Microsoft Exchange Server allows an authorized attacker to execute code remotely over a network.
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
A vulnerability in SQL Server allows an authorized attacker to elevate privileges over a network via external control of file name or path.
Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.
A race condition in Windows TCP/IP stack allows concurrent access to shared resources without proper synchronization. This enables an unauthorized attacker to execute code over an adjacent network.
A race condition vulnerability has been found in the Windows USB Print Driver during concurrent access to a shared resource. This flaw allows an authorized attacker to elevate privileges locally.
A use-after-free vulnerability in the Reliable Multicast Transport (RMCAST) driver allows an unauthorized attacker to execute code remotely over the network.
A heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
A heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
A race condition vulnerability in the Windows USB Print Driver allows an authorized local attacker to elevate privileges by exploiting improper synchronization of a shared resource.
A use-after-free vulnerability exists in the Quality Windows Audio/Video Experience (QWAVE) service. An authorized attacker can exploit this to elevate privileges locally.
Windows Overlay Filter has a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
A heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
A stack-based buffer overflow vulnerability in Active Directory Federation Services (AD FS) allows an unauthorized attacker to remotely execute code or cause a denial of service (DoS) by sending a specially crafted network request.
An integer underflow (wrap or wraparound) vulnerability in the Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
In Roundcube Webmail before versions 1.6.17 and 1.7.x before 1.7.2, a stored Cross-Site Scripting (XSS) vulnerability exists via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS