CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability.
A remote code execution vulnerability in Windows Print Spooler allows an attacker to execute arbitrary code with system privileges.
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
Podatność CVE-2021-32926 pozwala atakującemu na przechwycenie żądania zmiany hasła przez uwierzytelnionego użytkownika i zastąpienie go nielegalnym hashem. W wyniku tego użytkownik nie będzie mógł się uwierzytelnić w kontrolerze, co prowadzi do stanu odmowy usługi.
Zidentyfikowano podatność w rodzinie kontrolerów SIMATIC Drive oraz innych urządzeniach, które mogą być narażone na obejście ochrony pamięci. Atakujący zdalny, nieautoryzowany, mający dostęp do portu 102/tcp, może potencjalnie zapisywać dowolne dane i kod w chronionych obszarach pamięci lub odczytywać wrażliwe dane.
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature.
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.
In Versa Analytics, cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.
SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
W Arm Trusted Firmware M do wersji 1.2, świat NS może wywołać zatrzymanie systemu, nadpisanie danych zabezpieczonych lub wydrukowanie danych zabezpieczonych podczas wywoływania funkcji zabezpieczonych w trybie obsługi NSPE.
A stored cross-site scripting (XSS) vulnerability was found in the LuCI web interface for OpenWRT version 19.07. It allows an attacker to inject arbitrary JavaScript via the Hostname change operation.
The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS