CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The graphics components in Microsoft Windows 10 versions 1607, 1703, and Windows Server 2016 contain an elevation of privilege vulnerability due to improper handling of objects in memory.
A vulnerability in the graphics components of Microsoft Windows that allows for elevation of privilege due to improper handling of objects in memory. This affects multiple versions of Windows, including Windows 7, 8.1, 10, and Windows Server.
Microsoft Office umożliwia zdalne wykonanie kodu z powodu sposobu, w jaki obsługuje obiekty w pamięci. Jest to znane jako 'Podatność na zdalne wykonanie kodu w Microsoft Office'.
Microsoft SharePoint Server has an elevation of privilege vulnerability due to improper sanitization of a specially crafted web request to an affected SharePoint server.
A vulnerability in Microsoft Windows 1607, 1703, and Windows Server 2016 allows for elevation of privilege due to the Input Method Editor (IME) improperly handling parameters in a method of a DCOM class.
PowerShell in Windows has a vulnerability allowing remote code execution when PSObject wraps a CIM Instance. This affects multiple versions of Windows, including Windows Server 2008 and Windows 10.
A vulnerability in Microsoft Windows allows for elevation of privilege due to Kerberos falling back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol.
A vulnerability in Microsoft Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10, and Windows Server 2016 allows for elevation of privilege due to improper handling of calls to Advanced Local Procedure Call (ALPC).
The Windows kernel has a privilege escalation vulnerability due to the way it handles objects in memory. This affects multiple versions of Windows, including Windows 8.1, Windows 10, and Windows Server 2016.
In Microsoft Windows systems, including Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows 10, and Windows Server 2016, there is a vulnerability that allows elevation of privilege due to improper handling of objects in memory by the graphics component.
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.
Microsoft Office has a remote code execution vulnerability due to improper handling of objects in memory, known as 'Microsoft Office Memory Corruption Vulnerability'.
A vulnerability in Windows systems allows an attacker to bypass Extended Protection for Authentication when Kerberos fails to prevent tampering with the SNAME field during ticket exchange. This is known as 'Kerberos SNAME Security Feature Bypass'.
In Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016, there is a vulnerability that allows elevation of privilege due to the way it handles objects in memory.
Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 has a remote code execution vulnerability due to improper handling of executable files and shares during rename operations.
Microsoft Office allows a remote code execution vulnerability due to the way it handles objects in memory, known as 'Microsoft Office Remote Code Execution Vulnerability'.
The ReadTGAImage function in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.
iSmartAlarm cube devices are vulnerable to Denial of Service attacks. Sending a SYN flood on port 12345 causes the 'cube' to freeze and stop responding.
On iSmartAlarm cube devices, there is incorrect access control because a 'new key' is transmitted in cleartext.
On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.