CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Spoofing vulnerability in Microsoft SharePoint Server due to improper sanitization of specially crafted web requests. An authenticated attacker can send a crafted request and execute script in the security context of the current user.
An information disclosure vulnerability in Microsoft SharePoint Server where certain search function modes are vulnerable to cross-site search attacks (a CSRF variant). When users are logged in and visit a malicious page, the attacker can invoke search queries as the user, determining whether queries return results, thus discovering facts about searchable documents.
A cross-site-scripting (XSS) vulnerability in Microsoft SharePoint Server due to improper sanitization of specially crafted web requests. An authenticated attacker can send a crafted request, and upon exploitation, perform XSS attacks, read unauthorized content, act on behalf of the user (e.g., change permissions, delete content), and inject malicious content into the user's browser.
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server due to improper sanitization of specially crafted web requests. An authenticated attacker can send a crafted request and execute script in the security context of the current user.
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server due to improper sanitization of specially crafted web requests. An authenticated attacker can send a crafted request and execute script in the security context of the current user.
A remote code execution vulnerability in Microsoft Edge PDF Reader due to improper handling of objects in memory. An attacker could exploit a malicious PDF to execute code in the context of the current user.
Denial of Service vulnerability in Connected User Experiences and Telemetry Service due to improper validation of certain function values. An attacker must log on to the system and run a specially crafted application to exploit it, potentially denying dependent security feature functionality.
Denial of service vulnerability in Windows due to improper handling of objects in memory.
Information disclosure vulnerability in Windows Subsystem for Linux due to improper handling of objects in memory. An attacker could obtain information to further compromise the user's system.
Information disclosure vulnerability in the Windows kernel due to improper handling of objects in memory. An attacker must be logged on and run a specially crafted application. The vulnerability does not allow code execution or privilege escalation, but could be used to obtain information.
Elevation of privilege vulnerability in Windows due to improper handling of errors tied to Remote Access Common Dialog.
Remote code execution vulnerability in the ChakraCore scripting engine. An attacker can exploit this flaw to execute arbitrary code in the context of the current user, potentially leading to system compromise if the user has administrative rights.
Cross-site scripting vulnerability in Microsoft Dynamics 365 (on-premises) due to improper sanitization of crafted web requests. An authenticated attacker could perform XSS attacks and run scripts in the security context of the current authenticated user.
A spoofing vulnerability in Microsoft Edge due to improper parsing of HTTP content. An attacker can trick a user by redirecting to a specially crafted website that can spoof content or serve as a pivot for further attacks. Requires user clicking a specially crafted URL.
An elevation of privilege vulnerability in Microsoft Edge due to improper enforcement of cross-domain policies. An attacker could access information from one domain and inject it into another.
A cross-site-scripting (XSS) vulnerability in Active Directory Federation Services (ADFS) due to improper sanitization of user inputs. An unauthenticated attacker can send a crafted request to an affected ADFS server, and upon successful exploitation, perform XSS attacks and run scripts in the current user's security context.
Remote code execution vulnerability in the Chakra scripting engine in Microsoft Edge (HTML-based). An attacker can exploit this flaw to execute arbitrary code in the context of the current user, potentially leading to system compromise if the user has administrative rights. The attack can be carried out via a specially crafted website.
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
In MISP versions before 2.4.126, there is an XSS vulnerability in the resolved attributes view in app/View/Events/resolved_attributes.ctp.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS