CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
A 'use after free' vulnerability in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Xibo is an open source digital signage platform that prior to version 4.4.1 had a Server-Side Request Forgery (SSRF) vulnerability. This allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to network resources.
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
A vulnerability in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network using session fixation.
Visual Studio Code has improper neutralization of script-related HTML tags, leading to basic XSS vulnerability. This allows an unauthorized attacker to execute code locally.
An injection vulnerability in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over the network due to improper neutralization of special elements in output used by a downstream component.
Microsoft Edge (Chromium-based) has a vulnerability that allows external control of file name or path. This could enable an unauthorized attacker to disclose information over a network.
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
W systemie Windows Ancillary Function Driver for WinSock występuje podatność związana z dostępem do zasobów przy użyciu niekompatybilnego typu ('type confusion'). Umożliwia to autoryzowanemu atakującemu lokalne podniesienie uprawnień.
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
W Microsoft Office występuje podatność typu use after free, która pozwala autoryzowanemu atakującemu na lokalne podniesienie uprawnień.
A use after free vulnerability in Microsoft Office allows an authorized attacker to locally elevate privileges.
W Microsoft Office występuje podatność typu use after free, która pozwala autoryzowanemu atakującemu na lokalne podniesienie uprawnień.
Słaba autoryzacja w Dynamics Business Central umożliwia autoryzowanemu atakującemu podniesienie uprawnień lokalnie.
A use after free vulnerability in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
Podatność CVE-2026-40414 dotyczy systemu Windows i związana jest z możliwością wystąpienia ataku typu Denial of Service (DoS) w protokole TCP/IP. Atakujący może wykorzystać tę lukę, aby zablokować dostęp do usług sieciowych.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS