CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Elevation of privilege vulnerability in Azure CycleCloud. An attacker could exploit it to gain higher privileges in the CycleCloud environment.
Information disclosure vulnerability in Windows Services for NFS ONCRPC XDR driver. An attacker could access sensitive data.
Vulnerability in Windows Recovery Environment Agent allows elevation of privilege. Attacker can gain higher privileges in the system.
Elevation of privilege vulnerability in Azure Sphere. An attacker could exploit it to gain higher privileges on the system.
Elevation of privilege vulnerability in the Windows User Account Profile Picture feature. It allows a local attacker to elevate privileges.
Elevation of Privilege vulnerability in Windows Event Tracing. Allows an attacker to gain higher privileges.
Denial of Service vulnerability in .NET Core and Visual Studio. It could allow an attacker to cause application crashes.
Dell PowerScale OneFS w wersji 9.1.0.x zawiera lukę w zarządzaniu uprawnieniami. Umożliwia to uwierzytelnionemu użytkownikowi z uprawnieniami ISI_PRIV_LOGIN_SSH i/lub ISI_PRIV_LOGIN_CONSOLE podniesienie swoich uprawnień.
In the Linux kernel before version 5.13.4, a vulnerability exists that may allow remote attackers to cause a denial of service through out-of-bounds reads in strlen when the trace event framework is used for nfsd.
In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.
libcurl-using applications can request a specific client certificate to be used in a transfer. When built with the macOS native TLS library Secure Transport, a malicious user can trick the application into using a file-based certificate instead of the intended one, leading to the wrong client certificate being sent in the TLS handshake.
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Wersje Dell PowerScale OneFS od 8.1.0 do 9.1.0 zawierają podatność na niewłaściwe zarządzanie użytkownikami. W określonych warunkach, użytkownik CompAdmin może uzyskać podwyższone uprawnienia i wyjść z trybu zgodności.
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attacker to upload arbitrary files on affected installations. An attacker must first obtain the ability to logon to the product's management console.
In Eclipse Mosquitto versions 2.0.7 and earlier, the server crashes if a client sends a PUBLISH packet with topic length = 0.
TechSmith Snagit version 19.1.0.2653 uses OLE, which can allow attackers to obfuscate and embed crafted files used to escalate privileges. Snagit's use of OLE is a security vulnerability unto itself.
A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. Exploiting this vulnerability would require the end user to ignore other safety mechanisms provided by the Host OS.
An elevation of privilege vulnerability exists due to overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker could run arbitrary code with SYSTEM privileges, install programs, view/change/delete data, or create new accounts with full user rights.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Affected versions are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction and may significantly impact additional products. Successful attacks can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces Native Network Encryption changes to address this vulnerability. CVSS 3.1 Base Score 8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS