CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W systemie egzaminacyjnym itsourcecode Online Examination System w wersji 1.0 znaleziono lukę. Problem dotyczy nieznanej funkcjonalności pliku /index.php, która umożliwia wstrzyknięcie SQL poprzez manipulację argumentem Username.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the /endpoints/currency/currency component of Wallos v4.1.1. It allows attackers to execute arbitrary operations via a crafted GET request.
A time-of-check time-of-use (TOCTOU) race condition in Microsoft Defender for Linux allows an authorized attacker to cause a denial of service locally.
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
The vulnerability in Confidential Azure Container Instances involves external control of file name or path. An authorized attacker can exploit this vulnerability to elevate privileges locally.
The vulnerability in Confidential Azure Container Instances involves external control of file name or path. An authorized attacker can exploit this vulnerability to elevate privileges locally.
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network. The vulnerability affects Playwright versions used in GitHub.
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
A deserialization of untrusted data vulnerability in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
W obiektach COM skrzynki odbiorczej występuje problem z równoległym wykonywaniem przy użyciu współdzielonych zasobów z niewłaściwą synchronizacją, co prowadzi do wystąpienia warunku wyścigu. Umożliwia to nieautoryzowanemu atakującemu lokalne wykonanie kodu.
Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
A use after free vulnerability in Microsoft Office allows an unauthorized attacker to execute code locally.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. The flaw concerns the access control mechanism within this Windows component.
A use after free vulnerability in Microsoft Office allows an unauthorized attacker to execute code locally.
Nieprawidłowe neutralizowanie specjalnych elementów używanych w poleceniu SQL ('sql injection') w Microsoft Configuration Manager umożliwia nieautoryzowanemu atakującemu podniesienie uprawnień w sąsiedniej sieci.
Azure Connected Machine Agent has an improper access control vulnerability that allows an authorized attacker to elevate privileges locally.
An incorrect OIDC authentication flow in Claroty Secure Access versions 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS