CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Symfony's PdoAdapter allows an attacker to manipulate a DELETE statement by improperly handling the prefix. The lack of proper binding or escaping enables altering query semantics and deletion scope.
In Open5GS up to version 2.7.7, a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.
An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.
An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.
Use-After-Free vulnerability in Windows Client-Side Caching (CSC) Service. Allows an authorized attacker to elevate privileges locally.
A Use-After-Free vulnerability in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
A Use-After-Free vulnerability in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
A use-after-free vulnerability in Windows Win32K allows an authorized attacker to elevate privileges locally.
Use-After-Free vulnerability in Windows DirectX. Allows an authorized attacker to elevate privileges locally.
Race condition vulnerability in Windows Wireless Networking service that allows an authorized attacker to elevate privileges locally.
An unauthorized attacker can cause uncontrolled resource consumption in the Windows DHCP Server, leading to a denial of service (DoS) over the network. The vulnerability stems from a lack of limits in processing certain DHCP requests.
Use after free vulnerability in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
Use-After-Free vulnerability in Windows Sensor Data Service. Allows an authorized attacker to elevate privileges locally.
An improper access control vulnerability in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
A use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.
Use-After-Free vulnerability in Windows Management Services. Allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.
A type confusion vulnerability in Windows DWM allows an authorized attacker to elevate privileges locally.
Vulnerability in Windows Installer due to improper authorization. Allows an authorized attacker to elevate privileges locally.