CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability without user interaction. The scope of the vulnerability has changed.
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This could allow an attacker to gain elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page.
Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction and the scope is changed.
A vulnerability in the Vitest testing framework on Windows allows reading files outside the project via path traversal in /__vitest_attachment__ and arbitrary code execution through saveTestFile and rerun API functions. Fixed in versions 3.2.5 and 4.1.0.
A vulnerability in Vitest Browser Mode allows JavaScript injection via the otelCarrier query parameter in the /__vitest_test__/ path. An attacker can use a crafted URL to execute arbitrary code in the Vitest server origin and recover the VITEST_API_TOKEN for authenticated API calls.
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended locations.
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to and including 4.5.1. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.
A heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code remotely over a network.
Vulnerability in Microsoft Dynamics NAV involving deserialization of untrusted data, allowing an unauthorized attacker to execute code remotely over the network.
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
Minecraft Bedrock Dedicated Server has a heap-based buffer overflow. An unauthenticated attacker can execute code remotely on the server.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code remotely over a network.
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS