CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Null pointer dereference in Intel PROSet/Wireless WiFi drivers for Windows may lead to denial of service. The attack requires network access and low complexity, with no user interaction. The impact on system availability is high.
Improper buffer restrictions in Intel PROSet/Wireless WiFi drivers for Windows may lead to denial of service. The attack requires network access and low complexity, with no user interaction. The impact on system availability is high.
Improper access control in Intel PROSet/Wireless WiFi drivers for Windows may allow privilege escalation. The attack requires local access and low complexity, with no user interaction. The impact on confidentiality, integrity, and availability is low, low, and high, respectively.
Null pointer dereference in Intel PROSet/Wireless WiFi drivers for Windows may lead to denial of service. The attack requires network access and low complexity, with no user interaction. The impact on system availability is high.
Out-of-bounds read in Intel PROSet/Wireless WiFi drivers for Windows (Ring 0) may lead to denial of service. The attack requires network access and high complexity, with no user interaction. The impact on system availability is high.
Improper conditions check in Intel PROSet/Wireless WiFi drivers may lead to denial of service. The attack requires network access and low complexity, with no user interaction. The impact on system availability is high.
Out-of-bounds read in Intel PROSet/Wireless WiFi drivers may allow privilege escalation. The attack requires network access and low complexity, with no user interaction. The impact on confidentiality, integrity, and availability is low, low, and high, respectively.
Out-of-bounds write in Intel PROSet/Wireless WiFi drivers for Windows may lead to denial of service. The attack requires network access and low complexity, with no user interaction. The impact on integrity and availability is low and high, respectively.
Improper access control in Intel PROSet/Wireless WiFi drivers may lead to denial of service. The attack requires local access and low complexity, with no user interaction. The impact on system availability is high.
Improper conditions check in Intel PROSet/Wireless WiFi drivers for Windows may allow a network adversary to cause a denial of service. The attack requires low complexity and no user interaction, and can be performed via adjacent access. The vulnerability impacts system availability (high), with no impact on confidentiality or integrity.
A null pointer dereference in Intel PROSet/Wireless WiFi software for Windows in the kernel layer may allow a denial of service. An unprivileged software adversary with an unauthenticated user can exploit the vulnerability with low complexity, no user interaction, via adjacent access. The vulnerability impacts system availability (high), with no impact on confidentiality or integrity.
Improper access control in some Intel processors in the user application layer may allow an escalation of privilege. The attack requires an authenticated user, high complexity, and special internal knowledge, but no user interaction. The vulnerability impacts confidentiality and integrity (high), with no impact on availability.
Improper input validation in firmware for Intel Active Management Technology (AMT) and Intel Standard Manageability may allow a denial of service. A network adversary with an unauthenticated user can exploit the vulnerability with low complexity, no user interaction, via network access. The vulnerability impacts availability (high), with no impact on confidentiality or integrity.
A protection mechanism failure in Intel Data Center Attestation Primitives (DCAP) may allow information disclosure. An unprivileged software adversary with an unauthenticated user can exploit the vulnerability with low complexity, no user interaction, via network access. The vulnerability impacts integrity (high) and subsequent confidentiality (high), with no direct impact on confidentiality and availability.
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The issue is due to insufficient error checking when processing HTTP requests. An attacker could exploit this by sending a crafted HTTP request to the VPN service.
A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution.
Improper handling of overlap between protected memory ranges for some Intel Xeon 6 processors when using Intel TDX within SMM may allow an escalation of privilege. The attack requires a privileged user, high complexity, and special internal knowledge, but no user interaction. The vulnerability impacts confidentiality and integrity (high), with no impact on availability.
Sub2API, an AI API gateway platform, versions 0.1.135 to 0.1.168 have a vulnerability where tenant API keys are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator. The `POST /responses/*subpath` wildcard routes splice the client-supplied subpath into the upstream URL with no validation, allowing an authenticated tenant to relay requests to arbitrary upstream endpoints using pooled account credentials via path traversal. The vulnerability is fixed in 0.1.169.
Vim, an open source command line text editor, prior to 9.2.0840 has a vulnerability in runtime/plugin/netrwPlugin.vim and runtime/pack/dist/opt/netrw/autoload/netrw.vim where Bookmarks, History, and Targets menu entries are constructed by interpolating attacker-controlled directory paths into executed :menu commands. Functions s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. The issue is fixed in version 9.2.0840.
In Vim before 9.2.0839, the ftplugin plugins for sh, zsh, and ps1 pass attacker-controlled Visual-mode selections to keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before invoking bash, zsh, or PowerShell, allowing arbitrary OS commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.