CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In NTFS-3G versions prior to 2021.8.22, loading a specially crafted NTFS inode in the ntfs_inode_real_open function can trigger a heap buffer overflow, allowing code execution and privilege escalation.
In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow can occur when processing a specially crafted MFT section in an NTFS image, allowing code execution.
A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.
Spoofing vulnerability in Microsoft Edge for iOS. Could allow an attacker to impersonate trusted websites.
Spoofing vulnerability in Microsoft Edge for Android. Allows an attacker to impersonate trusted content.
Elevation of Privilege vulnerability in Microsoft Edge (Chromium-based). Could allow an attacker to gain elevated privileges.
Information disclosure vulnerability in Microsoft Edge for Android. Could allow access to sensitive data.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based). An attacker could exploit this flaw to gain elevated privileges on the system.
A Use After Free vulnerability in Adobe Acrobat Reader DC affects versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. An unauthenticated attacker could leverage this to achieve arbitrary code execution in the context of the current user, but requires user interaction to open a malicious file.
Występuje podatność typu CWE-476: dereferencja wskaźnika NULL, która może prowadzić do odmowy usługi na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum Ethernet oraz symulatorów PLC dla EcoStruxure.
Podatność CVE-2021-22791 dotyczy błędu zapisu poza granicami (CWE-787) w kontrolerach Modicon PLC, który może prowadzić do awarii usługi podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC.
Podatność CWE-125: Odczyt poza zakresem, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC dla EcoStruxure.
Występuje podatność CWE-119: Niewłaściwe ograniczenie operacji w granicach bufora pamięci, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum Ethernet, Quantum oraz Premium, a także symulatorów PLC dla EcoStruxure.
WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background, allowing attackers to steal cookies via a crafted payload in the search box.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
A vulnerability in the october/system package of October CMS allows an attacker to request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based). An attacker could exploit this flaw to gain elevated privileges on the system.
Information disclosure vulnerability in Microsoft Edge (Chromium-based). It could allow an attacker to access information that should not be disclosed.
A vulnerability in Microsoft Edge (Chromium-based) allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges in the browser context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS