CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. Grafana Cloud has never been vulnerable.
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data, which can be abused to gain remote code execution.
Vim jest podatny na przepełnienie bufora w stercie, co może prowadzić do nieautoryzowanego dostępu do pamięci. Atakujący może wykorzystać tę podatność do wykonania złośliwego kodu.
W BlueZ do wersji 5.48 odkryto podatność typu przepełnienie bufora na stercie w bluetoothd. Brak jest jakiejkolwiek weryfikacji, czy w docelowym buforze jest wystarczająco dużo miejsca, co prowadzi do przepełnienia bufora, gdy odpowiedź jest zbyt duża.
Podatność na ujawnienie informacji występuje, gdy użytkownik lub aplikacja przesyła niechronione dane klucza prywatnego jako część certyfikatu uwierzytelniającego w aplikacji Azure AD lub w usłudze Principal. Umożliwia to użytkownikowi lub usłudze z dostępem do odczytu aplikacji odczytanie danych klucza prywatnego.
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
The Diffie-Hellman Key Agreement Protocol allows remote attackers (client-side) to send arbitrary numbers that are not public keys, triggering expensive server-side DHE modular-exponentiation calculations, known as D(HE)at attack. The client needs minimal CPU and bandwidth. The attack may be more disruptive if the client can force the server to use its largest key size.
Remote code execution vulnerability in 3D Viewer. An attacker could exploit it to run arbitrary code in the context of the logged-in user.
Remote code execution vulnerability in 3D Viewer. An attacker could exploit it to run arbitrary code in the context of the logged-in user.
Visual Studio Code contains an Elevation of Privilege Vulnerability that could allow an attacker to gain elevated privileges on the system.
Microsoft Exchange Server Remote Code Execution Vulnerability. Details are not provided in the description, but it is a serious flaw allowing remote code execution.
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability. An attacker could exploit this vulnerability to execute code remotely in the Dynamics 365 environment.
Remote code execution vulnerability in Microsoft Defender. An attacker could exploit this vulnerability to execute arbitrary code on the system.
A vulnerability in Microsoft Word allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
Microsoft Excel Security Feature Bypass Vulnerability. Details are not provided in the description, but it allows an attacker to bypass security features.
Elevation of privilege vulnerability in Active Directory Domain Services. Allows an attacker to gain elevated privileges in the domain.
Active Directory Domain Services Elevation of Privilege Vulnerability. Technical details are not provided in the description.
Windows Core Shell SI Host Extension Framework for Composable Shell contains an Elevation of Privilege Vulnerability that could allow an attacker to gain elevated privileges on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS