CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
A deserialization of untrusted data vulnerability in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.
Command injection vulnerability in Microsoft Copilot. An unauthorized attacker can remotely tamper with the application over a network.
Unrestricted upload of dangerous file types in Azure Orbital Spatio allows an unauthorized attacker to execute code remotely over the network.
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code remotely over the network.
Microsoft Azure Active Directory B2C contains an authentication bypass vulnerability using an alternate path or channel, allowing an unauthorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in a command (command injection) in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.
An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.
Typebot versions 3.15.2 and prior have an SSRF vulnerability in the preview chat endpoint. An unauthenticated attacker can supply a custom typebot definition with server-side code, bypassing SSRF validation and making network requests from the server.
In Sunshine, a self-hosted game stream host for Moonlight, versions prior to 2026.516.143833, client-certificate authentication can be bypassed due to how OpenSSL verification results are handled. The custom verify callback treats some errors as success, allowing untrusted certificates.
The ToASCII and ToUnicode functions in the idna library incorrectly accept Punycode-encoded labels that decode to an ASCII-only label, which can lead to privilege escalation in programs using this library.
Insufficient session expiration in syslink software AG Avantra on Linux and Windows allows reusing session IDs (Session Replay). This issue affects Avantra before version 25.3.1.
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF. It allows an attacker to retrieve arbitrary certificates from the repository.
An attacker sending TCP, IL, RUDP, or GRE packets with a length less than the header size can trigger a kernel panic.
The fix for CVE-2024-45337 regarding bypass of source address validation in SSH configurations is considered incomplete. If a callback type other than public key is used, source address validation may be skipped.
Vulnerability in the revocation mechanism of 'SignatureKey' belonging to a CA. Previously, a revoked key was not correctly checked; now both 'key' and 'key.SignatureKey' are verified for revocation.
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused an infinite loop sending empty packets. The fix uses int64 for size comparison to prevent truncation.
The in-memory NewKeyring() function silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without confirmation, with no indication to the caller. NewKeyring() now returns an error when unsupported constraints are requested.
When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.
Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.