CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
ServiceNow has addressed a reflected cross-site scripting vulnerability identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has deployed security updates to most hosted instances and provided updates to self-hosted customers and partners.
ServiceNow has addressed a reflected cross-site scripting vulnerability identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has deployed security updates to most hosted instances and provided updates to self-hosted customers and partners.
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the associate_by_email pipeline was not included, potentially leading to account compromise when a third-party authentication service does not validate e-mail addresses or require unique ones. Version 5.6.0 contains a patch.
The Trustee project in Confidential Containers before version 0.15.0 did not check if the kbs-client submitting a request to the attestation-policy endpoint was authenticated. This allowed any kbs-client to change the attestation policy.
pyLoad to darmowy menedżer pobierania napisany w Pythonie. W wersjach przed 0.5.0b3.dev91 interfejs webowy pyLoad zawierał niewystarczającą walidację danych wejściowych, co umożliwiało atakującym wstrzykiwanie dowolnych treści do interfejsu webowego lub manipulację obsługą żądań.
Mechanizm uwierzytelniania w Perfex CRM przed wersją 3.3.1 pozwala atakującym na ominięcie danych logowania z powodu niewystarczającej walidacji po stronie serwera. Wysyłając puste parametry nazwy użytkownika i hasła w żądaniu logowania, atakujący może uzyskać nieautoryzowany dostęp do kont użytkowników, w tym kont administracyjnych, bez podawania ważnych danych uwierzytelniających.
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
A command injection vulnerability in Copilot allows an unauthorized attacker to perform information disclosure locally. It stems from improper neutralization of special elements used in commands.
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
Azure PlayFab has an Elevation of Privilege Vulnerability.
An Elevation of Privilege vulnerability has been identified in Azure Entra ID. Technical details are not provided in the description.
An Elevation of Privilege vulnerability in Azure Entra ID allows an attacker to gain higher privileges in the cloud environment. Technical details were not disclosed in the description.
A Cross-site Scripting (XSS) vulnerability in Azure Monitor stems from improper neutralization of input during web page generation. It allows an unauthorized attacker to perform spoofing over a network.
A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeeper checks.
Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication, which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
Newforma Info Exchange (NIX) allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account.
Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.
Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter. An attacker can use this parameter to redirect users to an arbitrary site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS