CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4, 10.x, and 11.x. A remote authenticated user can access internal API functions and upload and execute arbitrary code.
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out-of-bounds write due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed.
The BN_mod_sqrt() function contains a bug that can lead to an infinite loop for non-prime moduli. This bug can be triggered by crafting a certificate with invalid explicit curve parameters.
A vulnerability in Printix Secure Cloud Print Management up to version 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation due to a race condition.
A remote code execution vulnerability exists in KeyMouse Windows version 3.08 and prior during an unauthenticated update. Exploitation requires the user to trigger an update of an affected KeyMouse installation.
The Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, allowing unprivileged local users to elevate privileges to SYSTEM via the 'Browse For Folder' window accessible by triggering a repair on the MSI package located in C:\Windows\Installer.
A flaw in the initialization of the "flags" member of the new pipe buffer structure in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel. An unprivileged local user can overwrite page cache pages backed by read-only files and escalate privileges.
Wykryto podatność typu przepełnienie sterty w bluez w wersjach przed 5.63. Atakujący z dostępem do lokalnej sieci mógł przesłać specjalnie przygotowane pliki, co mogło spowodować zatrzymanie lub awarię aplikacji, prowadząc do odmowy usługi.
A NULL pointer dereference flaw in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux kernel, requiring CAP_SYS_ADMIN, allows a local attacker to crash the system or leak kernel internal information. The highest threat is to system availability.
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
A vulnerability in VP9 video extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
.NET and Visual Studio contain a Denial of Service (DoS) vulnerability that can lead to service unavailability.
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
The vulnerability in HEIF image extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
A vulnerability in VP9 video extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
A vulnerability in Paint 3D allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to run malicious software on the compromised device.
Wtyczka WP Visitor Statistics (Real Time Traffic) dla WordPressa w wersjach przed 5.6 nie sanitizuje i nie ucieka parametru id przed użyciem go w zapytaniu SQL za pośrednictwem akcji AJAX refUrlDetails, dostępnej dla każdego uwierzytelnionego użytkownika, co prowadzi do podatności na wstrzyknięcie SQL.
In the Linux kernel's NFC driver st21nfca (drivers/nfc/st21nfca/se.c), the function st21nfca_connectivity_event_received has buffer overflows in EVT_TRANSACTION due to untrusted length parameters. The vulnerability affects versions up to 5.16.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS