CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote code execution vulnerability exists in the Windows Print Spooler service due to improper privileged file operations. An attacker can exploit it to run arbitrary code with SYSTEM privileges, allowing them to install programs, modify data, or create accounts with full user rights. Microsoft has released security updates, but additional registry and Group Policy settings must be verified.
Use-after-free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Tesseract OCR version 5.0.0-alpha-20201231 contains a use-after-free vulnerability in the one_ell_conflict function during a strpbrk call. The flaw may lead to improper access to freed memory.
Plixer Scrutinizer 19.0.2 is affected by SQL Injection vulnerability. An attacker can remotely obtain sensitive information.
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the kernel thread associated with queue 0, leading to a use-after-free when the backend is destroyed.
W MVISION EDR (MVEDR) przed wersją 3.4.0 występuje podatność na wstrzykiwanie poleceń, która pozwala uwierzytelnionemu administratorowi MVEDR na wywołanie klienta EDR do wykonania dowolnych poleceń za pomocą PowerShell poprzez funkcjonalność EDR 'wykonaj reakcję'.
In MISP version 2.4.144, the file app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp does not sanitize certain data related to generic-template:index.
A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.
PHPGurukul Hospital Management System v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated attackers can exploit it to obtain sensitive database information.
A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
D-Link DIR-2640-US router version 1.01B04 stores the system account password in plain text. It does not use Linux user management, and all devices share the same unchangeable password. An attacker can easily log in via the serial port and gain root privileges.
D-Link DIR-2640-US router version 1.01B04 has an incorrect access control vulnerability. When setting up PPPoE, it starts the Quagga process for whole network monitoring using default credentials and port. An attacker can easily log in via Telnet, modify routing, monitor all device traffic, hijack DNS, and perform phishing attacks.
D-Link DIR-2640-US router version 1.01B04 is vulnerable to buffer overflow. Multiple out-of-bounds vulnerabilities exist in some processes of the device. Local ordinary users can overwrite global variables in the .bss section, causing process crashes or changes.
Multiple out-of-bounds vulnerabilities were found in D-Link AC2600 (DIR-2640) firmware version 1.01B04. They allow privilege escalation from ordinary to administrator permissions, leading to local arbitrary code execution.
In InsydeH2O 5.x, certain SMM drivers did not correctly validate CommBuffer and CommBufferSize parameters, allowing callers to corrupt firmware or OS memory. Affected drivers include AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe.
A vulnerability in SafeNet KeySecure Management Console 8.12.0 allows HTTP response splitting attacks. A remote attacker can exploit a specially crafted URL to cause the server to return a split response when the URL is clicked.
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A CWE-552 vulnerability in Easergy T300 firmware versions V2.7.1 and older allows unauthorized attackers to access system files and directories. Lack of proper access restrictions can lead to exposure of sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS