CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Remote code execution vulnerability in the VBScript engine when handling objects in memory. An attacker could corrupt memory and execute arbitrary code in the context of the current user, potentially leading to full system compromise if the user has administrative rights.
Remote code execution vulnerability in the VBScript engine when handling objects in memory. An attacker could corrupt memory and execute arbitrary code in the context of the current user, potentially leading to full system compromise if the user has administrative rights.
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode, install programs, view/change/delete data, or create new accounts with full user rights.
A remote code execution vulnerability in Windows Jet Database Engine due to improper handling of objects in memory. An attacker could exploit it by enticing a victim to open a specially crafted file. The update corrects the way objects are handled in memory.
Elevation of privilege vulnerability in Windows Print Spooler service that improperly allows arbitrary writing to the file system. An attacker could run arbitrary code with elevated system privileges.
A remote code execution vulnerability in the VBScript engine due to improper handling of objects in memory. An attacker could exploit it in a web-based attack scenario by convincing a user to visit a malicious website. The update modifies how the scripting engine handles objects in memory.
Memory corruption vulnerability in Windows Media Foundation due to improper handling of objects in memory. An attacker could install programs, view/change/delete data, or create new accounts with full user rights.
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when it handles and executes files. An attacker could exploit it by running a specially crafted application to gain greater access to sensitive information and system functionality.
Elevation of privilege vulnerability in Windows Block Level Backup Engine Service (wbengine) that allows file deletion in arbitrary locations. An attacker who logs on can run a specially crafted application to take control of the system.
Denial of service vulnerability in Hyper-V on Windows Server due to improper handling of specially crafted network packets. An attacker could send such packets to the Hyper-V server, causing service failure.
In Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103, if an attacker can control the contents and name of a file on the server, and the server is configured with PersistenceManager using FileStore and appropriate filters, remote code execution via deserialization is possible.
W pip (wszystkie wersje) odkryto problem, który polega na instalacji wersji z najwyższym numerem, nawet jeśli użytkownik zamierzał uzyskać prywatny pakiet z prywatnego indeksu. Problem ten dotyczy tylko użycia opcji --extra-index-url.
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
A vulnerability in ARP packet processing of Cisco ASA and Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, adjacent attacker to cause a device reload, resulting in a denial of service (DoS). The issue is due to incorrect processing of ARP packets on the management interface. An attacker could exploit this by sending a series of unicast ARP packets in a short timeframe, consuming resources and preventing keepalives, leading to a reload.
A vulnerability in the DHCP module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This is due to incorrect processing of certain DHCP packets. An attacker could exploit this by sending a crafted DHCP packet, causing a DoS.
A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to incorrect processing of certain BGP packets. An attacker could exploit this by sending a crafted BGP packet, causing a DoS.
A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to improper management of system memory. An attacker could exploit this by sending malicious IKEv1 traffic, causing a DoS.
A vulnerability in the OSPF implementation of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The issue is due to improper memory protection mechanisms while processing certain OSPF packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS