CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An elevation of privilege vulnerability exists in Windows Print Spooler. Technical details are not provided in the description, but the vulnerability could allow an attacker to gain elevated privileges on the system.
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server is running as a reverse proxy via a specially crafted request.
A data race vulnerability exists in audio in Google Chrome prior to 89.0.4389.72. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
Maxum Rumpus 8.2.13 and 8.2.14 are affected by a command injection vulnerability. The user management functionality in the web administration panel contains a parameter that, due to insufficient validation, allows execution of arbitrary system commands.
A CSRF vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows an attacker to perform unintended actions in the web application if an authenticated user visits a malicious page.
Podatność dotyczy wszystkich wersji pakietu github.com/nats-io/nats-server/server. Nieufne konta mogą spowodować awarię serwera, używając konfiguracji, które reprezentują cykle eksportu/importu usług.
In the Linux kernel through 5.11.3, iSCSI data structures lack proper length constraints, allowing an unprivileged user to send a Netlink message up to the maximum length.
In the Linux kernel up to version 5.11.3, a vulnerability in the SCSI driver (drivers/scsi/scsi_transport_iscsi.c) allows an unprivileged user to craft Netlink messages, adversely affecting the system.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
PHP object injection vulnerability in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
Rockwell Automation Studio 5000 Logix Designer w wersjach 21 i nowszych oraz RSLogix 5000 w wersjach od 16 do 20 są podatne na atak, który pozwala nieautoryzowanemu użytkownikowi obejść mechanizm weryfikacji komunikacji z kontrolerami Logix. Atakujący może uwierzytelnić się z użyciem urządzeń CompactLogix i ControlLogix.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code in the context of the system on the Exchange server.
A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.
A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.
Microsoft Exchange Server contains a remote code execution vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS