CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.
Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
A null pointer dereference vulnerability in Windows DirectX allows an authorized attacker to deny service locally.
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.
Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: the Supplier indicates that they are unable to reproduce this.
A cross-site scripting (XSS) vulnerability was found in phpIPAM v1.7.3 in the Request IP form. It allows remote attackers to inject arbitrary web script or HTML via the instructions parameter at the /app/admin/instructions/edit-result.php endpoint.
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically crafted HTTP or HTTPS commands.
An improper verification of cryptographic signature vulnerability exists in Fortinet FortiWeb versions 8.0.0, 7.6.0 through 7.6.4, and 7.4.0 through 7.4.9. This may allow an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response message.
A vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager related to improper verification of cryptographic signature allows an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response message.
Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, and all versions of 6.5, 6.4, 6.3 have a forced browsing vulnerability that allows an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS