CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer overflow or wraparound vulnerability in Windows HTTP.sys allows an unauthorized attacker to execute code remotely over a network.
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
A use-after-free vulnerability in the Windows Kernel allows an unauthorized attacker to execute code remotely over a network.
A vulnerability in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network. No CWE identifier is assigned for this issue.
A stack-based buffer overflow in the Windows DHCP Client allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.
A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.
The vulnerability in OpenSSL involves improper processing of AuthEnvelopedData containers in CMS, where insufficient validation of cipher and tag length fields allows an attacker to replace the cipher with an unauthenticated one (e.g., AES-256-OFB) or reduce the tag length to a single byte. This can lead to key-equivalent functionality for a chosen recipient and bypass of message integrity.
Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
CBS Platform from MOSK Information Technologies Ltd. is vulnerable to SQL injection due to improper neutralization of special elements. The product is unsupported.
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
An Authentication Bypass vulnerability in Ivanti Sentry before versions R10.5.2, R10.6.2, and R10.7.1 allows a remote unauthenticated attacker to create arbitrary administrative accounts. This leads to full administrative access.
An OS Command Injection vulnerability in Ivanti Sentry before versions R10.5.2, R10.6.2 and R10.7.1. A remote unauthenticated user can achieve root-level remote code execution.
E-İmar from Netcad Software Inc. versions 2.10.1.0 through before 3.0.2 is vulnerable to SQL injection due to improper neutralization of special elements.
In the Linux kernel, the RDMA/rxe driver has a vulnerability due to incorrect iova-to-va conversion for memory regions (MR) with page sizes different from PAGE_SIZE. This bug causes wrong pointer calculations during memory access, potentially leading to a kernel panic.
In the Linux kernel, KVM/arm64 vgic-its has a bug in vgic_its_invalidate_cache() that can drop the same reference multiple times during concurrent cache invalidation, leading to use-after-free.
The WordPress Insert PHP plugin before version 3.3.1 contains a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
SQL injection in the 'two_steps_auth_code' parameter processed by the 'twoStepsAuthVerification' function in the '/user-login' endpoint. The 2FA functionality is accessible without authentication, allowing unauthenticated attackers to execute arbitrary SQL queries. Successful exploit can lead to database enumeration, unauthorized creation of privileged users, modification or deletion of critical information, and denial of service.
ARM Cortex and Neoverse series processors may allow writes to resources owned by a higher exception level. The vulnerability affects multiple models including Cortex-X925, Cortex-X4, Neoverse V3 and others.
A vulnerability in the Catalyst::Plugin::Authentication library for Perl before version 0.10_027 allows session fixation attacks. The library does not automatically change the session ID after authentication, enabling an attacker to hijack the victim's session.