CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Improper handling of insufficient permissions in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (TOCTOU) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.
A race condition exists in the Capability Access Management Service (camsvc) due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
A race condition exists in the Graphics Kernel due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
A type confusion vulnerability in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
A vulnerability in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. The issue involves freeing memory not on the heap.
A time-of-check time-of-use (TOCTOU) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
A race condition exists in the Printer Association Object due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
A vulnerability in Windows Deployment Services is due to improper access control. An unauthorized attacker can execute code over an adjacent network.
Zidentyfikowano podatność w punktach dostępowych HPE Networking Instant On, która pozwala na wprowadzenie urządzenia w stan nieodpowiedzi po przetworzeniu specjalnie skonstruowanego pakietu. W niektórych przypadkach może być konieczny twardy reset, aby przywrócić usługi.
Podatność w konfiguracji trybu routera punktów dostępowych HPE Instant On ujawnia szczegóły konfiguracji sieci do niezamierzonych interfejsów. Złośliwy aktor mógłby uzyskać informacje o wewnętrznej konfiguracji sieci poprzez analizę dotkniętych pakietów.
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting, leading to a potential use-after-free.
Podatność CVE-2025-68707 dotyczy routera Tongyu AX1800 z firmware 1.0.0, która pozwala atakującym z sieci lokalnej na ominięcie uwierzytelnienia i wprowadzenie dowolnych zmian w konfiguracji, o ile aktywna jest sesja administratora. Może to prowadzić do pełnego przejęcia urządzenia.
An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources and reference counting, creating a potential write use-after-free scenario.
Dell SupportAssist OS Recovery w wersjach przed 5.5.15.1 zawiera podatność na tworzenie plików tymczasowych z niebezpiecznymi uprawnieniami. Atakujący z niskimi uprawnieniami i lokalnym dostępem może wykorzystać tę podatność do podniesienia swoich uprawnień.
W Eptura Archibus w wersji 2024.03.01.109 komponenty 'Uruchom skrypt' oraz 'Plik serwera' w 'Kreatorze aktualizacji bazy danych' są podatne na atak typu traversal katalogu.