CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Bridge versions 12.0.3 and earlier and 13.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this to bypass mitigations such as ASLR, but exploitation requires user interaction to open a malicious file.
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
Fortinet FortiWeb versions 7.0.0 through 7.0.1 and FortiWeb 6.4 all versions contain a use of externally-controlled format string vulnerability allowing an attacker to execute unauthorized code or commands via specially crafted command arguments.
Fortinet FortiOS and FortiProxy contain an improper neutralization of CRLF sequences in HTTP headers (HTTP response splitting). An authenticated remote attacker can perform an HTTP request splitting attack, gaining control of the remaining headers and body of the response.
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
Denial of Service vulnerability in Visual Studio.
Git is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding crafted input to `git apply`, a path outside the working tree can be overwritten as the user running `git apply`.
An information disclosure vulnerability in Azure Machine Learning Compute Instance. An attacker could exploit this to gain unauthorized access to data.
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Spoofing Vulnerability in Microsoft Edge (Chromium-based). An attacker could impersonate a trusted source.
Denial of service vulnerability in .NET Framework.
Elevation of privilege vulnerability in Microsoft OneNote.
Tampering vulnerability in Microsoft Edge (Chromium-based).
Information disclosure vulnerability in Microsoft Office. An attacker could exploit this flaw to gain access to sensitive data.
Remote code execution vulnerability in Azure Data Box Gateway.
Information disclosure vulnerability in Windows Internet Storage Name Service (iSNS) Server.
An information disclosure vulnerability in Windows Internet Storage Name Service (iSNS) Server. Technical details are not provided in the description.
Remote code execution vulnerability in Windows Fax Service. An attacker could remotely execute arbitrary code on the vulnerable system.
Information Disclosure vulnerability in Microsoft PostScript and PCL6 Class Printer Driver. Could allow unauthorized access to data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS