CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because the user login stored in the session was not verified. An unauthenticated attacker may exploit this to escalate privileges and gain admin access to Zabbix Frontend.
W wersji 1.4.0 Trusted Firmware-M (TF-M) przy użyciu profilu Small występuje nieprawidłowa kontrola dostępu. NSPE może uzyskać dostęp do zabezpieczonego klucza (przechowywanego przez usługę Crypto) jedynie na podstawie znajomości jego identyfikatora klucza.
In the JPress v4.2.0 admin panel, there is a function that allows template modification. Attackers can inject malicious code, leading to full site compromise.
Windows User Profile Service Elevation of Privilege Vulnerability.
Win32k Elevation of Privilege Vulnerability.
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
A vulnerability in Microsoft Office allows for remote code execution, potentially leading to full control over the user's system. An attacker can exploit this flaw through malicious documents that the user opens.
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to trigger a DoS condition. It is due to improper input validation when parsing HTTPS requests. An attacker can send a malicious HTTPS request to cause the device to reload, resulting in DoS.
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to trigger a DoS condition. It is due to improper input validation when parsing HTTPS requests. An attacker can send a malicious HTTPS request to cause the device to reload, resulting in DoS.
An improper check or handling of exceptional conditions in the NPU driver allows arbitrary memory write and code execution.
Podatność w zarządzaniu informacjami w urządzeniu bone voice ID TA może prowadzić do naruszenia poufności danych. Jej skuteczne wykorzystanie może wpłynąć na bezpieczeństwo przechowywanych informacji.
Podatność w identyfikatorze głosu TA w systemie bone polega na błędnym obliczaniu długości bufora. Skuteczne wykorzystanie tej podatności może wpłynąć na poufność danych.
Aplikacja zaufana (TA) bone voice ID posiada podatność na przepełnienie sterty. Udana eksploitacja tej podatności może wpłynąć na poufność danych.
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
Podatność CVE-2022-0121 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w aplikacji hoppscotch. Problem ten występuje w wersjach przed 2.1.1.
An issue was discovered in SdHostDriver in InsydeH2O with kernels 5.1 through 5.5. A vulnerability in the SMM branch registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData).
A vulnerability in IdeBusDxe in InsydeH2O with kernel 5.1-5.5 involves a SWSMI handler that does not sufficiently validate the allocated buffer pointer, potentially allowing an attacker to manipulate SMRAM data.
An issue was discovered in AhciBusDxe in InsydeH2O with kernels 5.1 through 5.5. A vulnerability in the SMM branch registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS