CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Microsoft Excel and related products allows remote attackers to execute arbitrary code via a crafted document. This affects multiple versions of Excel and SharePoint services.
A vulnerability in Microsoft Office and related services allows remote attackers to execute arbitrary code via a crafted document. This affects multiple versions of Office as well as SharePoint and Office Web Apps services.
The GDI in Microsoft Windows 10 1607 allows remote attackers to execute arbitrary code via a crafted document.
The GDI interface in Microsoft Windows allows local users to gain elevated privileges via a crafted application. This affects multiple versions of Windows, including Vista, 7, 8.1, and 10.
Microsoft Internet Explorer versions 9 through 11 mishandles .url files from the Internet zone, allowing remote attackers to bypass intended access restrictions via a crafted file.
Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 (Gold, 1511, and 1607) have a vulnerability that improperly checks NTLM SSO requests for MSA logins. This allows remote attackers to more easily determine passwords via a brute-force attack on NTLM password hashes.
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka 'Microsoft Browser Information Disclosure Vulnerability.'
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application.
Kernel-mode drivers in Microsoft Windows allow local users to gain elevated privileges via a crafted application. This affects multiple versions of Windows, including Vista, 7, 8.1, and 10.
A vulnerability in Microsoft Windows 10 Gold, 1511, and 1607 that improperly enforces permissions, allowing local users to gain Administrator access via a crafted DLL.
The SMBv1 server in Microsoft Windows allows remote attackers to execute arbitrary code via crafted packets. This affects multiple versions of Windows, including Vista, 7, 8.1, and 10.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
The kernel in various versions of Windows mishandles session objects, allowing local users to hijack sessions and gain elevated privileges via a crafted application.
The kernel in various versions of Windows mishandles session objects, allowing local users to hijack sessions and gain elevated privileges via a crafted application.
Microsoft Internet Explorer versions 9 through 11 and Microsoft Edge have a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka 'Microsoft Edge Memory Corruption Vulnerability,' a different vulnerability than CVE-2016-3330.
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.