CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Microsoft Dynamics NAV involving deserialization of untrusted data, allowing an unauthorized attacker to execute code remotely over the network.
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
Minecraft Bedrock Dedicated Server has a heap-based buffer overflow. An unauthenticated attacker can execute code remotely on the server.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code remotely over a network.
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
A vulnerability in the Mojolicious library for Perl (versions 4.59 through 9.48) exposes a stable CSRF token representation to a BREACH compression oracle. The token is generated once per session and placed in a hidden `csrf_token` field, and when the response echoes attacker-controlled input and is gzip-compressed, the token can be recovered.
In sigstore-js prior to version 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key.
A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
A vulnerability in Pillow before version 12.3.0 allows an attacker to read process memory or cause a fault when loading an uncompressed McIdas AREA image via the mmap codec path. Attacker-controlled header words can set a row stride smaller than the natural row width, leading to out-of-bounds read beyond the mapped region.
Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.
Use-after-free vulnerability in the Windows kernel allows an unauthorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.
Command injection vulnerability in Copilot Chat within Microsoft Edge. An unauthorized attacker can remotely execute code on the victim's device.
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.
A vulnerability has been found in Totolink NR1800X firmware version 9.1.0u.6279_B20210910 in the Form_Logout function of the /formLogout.htm file within the lighttpd component. Manipulation of the Host argument causes a stack-based buffer overflow, which can be exploited remotely.