CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands. The flaw is due to improper validation of user-supplied input, and exploitation occurs via malicious HTTP POST requests. Successful exploitation allows execution of arbitrary commands on the underlying Linux shell as root.
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Spring Web Services versions 2.4.3, 3.0.4, and older unsupported versions of all three projects are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. This affects multiple versions of Windows, including Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers.
A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, 10, 11, Microsoft Excel Viewer, and Office 365 ProPlus.
Dokan w wersjach od 1.0.0.5000 do 1.2.0.1000 jest podatny na przepełnienie bufora na stosie w sterowniku dokan1.sys. Atakujący może stworzyć uchwyt urządzenia do sterownika systemowego i wysłać dowolne dane wejściowe, które wywołają tę podatność.
W wersji 1.8.2 biblioteki libsixel występuje błąd przepełnienia bufora w pamięci sterty w funkcji load_jpeg() w pliku loader.c, co zostało zademonstrowane przez img2sixel.
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center and other tools expose functionality to read/write data from/to IO ports. This could be leveraged to run code with elevated privileges.
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center and other tools expose functionality to read and write arbitrary physical memory. A local attacker could leverage this to elevate privileges.
The GDrv low-level driver in GIGABYTE APP Center and other tools exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
Netatalk w wersjach przed 3.1.12 jest podatny na zapis poza granicami w pliku dsi_opensess.c. Problem wynika z braku sprawdzania granic na danych kontrolowanych przez atakującego.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This affects Internet Explorer 9, 10, and 11. This CVE ID is unique from CVE-2018-8643.
Wszystkie wersje ARM Trusted Firmware do i włącznie z wersją 1.4 nie inicjalizują ani nie zapisują/przywracają rejestru PMCR_EL0, co może prowadzić do wycieku informacji o czasie w bezpiecznym świecie.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. This affects multiple versions of Windows, including Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. This affects multiple versions of Windows, including Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers.
NoneCms V1.3 has a vulnerability in thinkphp/library/think/App.php that allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the query string s=index/\think\Request/input&filter=phpinfo&data=1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS