CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Vulnerability in Firefox for iOS < 25. The token used for native-to-JS bridging was leaking, potentially allowing non-app code to call bridging functions.
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based) due to improper input validation in the Feedback extension. An attacker could write files to arbitrary locations and gain elevated privileges. The vulnerability alone does not allow arbitrary code execution but can be chained with other vulnerabilities.
Remote code execution vulnerability in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker could run arbitrary code in the context of the current user, potentially taking control of the system if the user has administrative rights.
An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
Remote code execution vulnerability in Windows Jet Database Engine due to improper handling of objects in memory. An attacker could execute arbitrary code on a victim's system if the victim opens a specially crafted file.
Remote code execution vulnerability in Windows Jet Database Engine due to improper handling of objects in memory. An attacker could execute arbitrary code on a victim's system if the victim opens a specially crafted file.
A remote code execution vulnerability in Windows Jet Database Engine due to improper handling of objects in memory. An attacker could exploit it by enticing a victim to open a specially crafted file. The update corrects the way objects are handled in memory.
A spoofing vulnerability in Microsoft Power BI Report Server due to improper validation of uploaded attachment content-type. An authenticated attacker can upload a crafted payload, and when opened by a user, execute actions and scripts in the user's security context.
Remote code execution vulnerability in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker could run arbitrary code in the context of the current user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS