CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Elevation of privilege vulnerability in Windows Feedback Hub.
A memory corruption vulnerability in the Chakra Scripting Engine.
Elevation of Privilege Vulnerability in Diagnostics Hub Standard Collector. An attacker could gain elevated privileges.
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability.
Windows Installer Elevation of Privilege Vulnerability. Details are not provided in the description, but it allows privilege escalation.
Information Disclosure Vulnerability in Azure Sphere. An attacker could gain access to sensitive information.
Information disclosure vulnerability in Azure Sphere. Could allow an attacker to gain unauthorized access to data.
Information Disclosure Vulnerability in FSLogix. An attacker could gain access to sensitive information.
Information Disclosure vulnerability in Windows Remote Desktop Protocol (RDP). Could allow an attacker to gain unauthorized access to data.
A remote code execution vulnerability in Microsoft Access. An attacker could exploit this to execute arbitrary code in the context of the current user.
A spoofing vulnerability in Microsoft Edge (Chromium-based) in IE Mode. An attacker could exploit this to impersonate trusted websites.
Spoofing vulnerability in Microsoft Exchange Server. An attacker can impersonate another entity, potentially leading to fraud or unauthorized actions.
Information disclosure vulnerability in Windows Remote Desktop Protocol (RDP).
All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.
CVE-2021-39904 describes an improper access control vulnerability in the GraphQL API in all versions of GitLab CE/EE from 13.1 to 14.2.6, from 14.3 to 14.3.4, and from 14.4 to 14.4.1. This allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request.
An XSS vulnerability in Pandora FMS up to version 755 allows an attacker to inject malicious script by creating a new event filter with a crafted name.
A vulnerability in Artica Pandora FMS up to version 755 allows an admin to overwrite the .htaccess file via the File Manager component. The new .htaccess contains a Rewrite Rule with a file type definition, enabling upload of a normal PHP file and code execution via an HTTP request.
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
A Cross Site Scripting (XSS) vulnerability was found in DynPG 4.9.1. An authenticated attacker can execute arbitrary JavaScript code via the groupname parameter.
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS