CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Microsoft Azure File Sync allows elevation of privilege. An attacker could exploit this flaw to gain unauthorized access to resources.
A vulnerability in Windows Cryptographic Services allows information disclosure. An attacker could exploit this flaw to read sensitive data stored in system memory.
A vulnerability in the Windows Container Manager Service allows elevation of privilege. An attacker can exploit this flaw to gain higher privileges on the system.
A vulnerability in Windows Remote Access Connection Manager could lead to information disclosure. An attacker may exploit this flaw to access sensitive data stored on the system.
A vulnerability in Winlogon allows elevation of privilege in Windows systems. An attacker could exploit this flaw to gain higher privileges on the device.
A vulnerability in the Winlogon component of Windows allows elevation of privilege. This flaw can be exploited by a local attacker to gain higher privileges on the system.
A vulnerability in Windows Themes allows a Denial of Service (DoS) attack. An attacker can exploit a specially crafted theme file to cause system crash or hang.
A remote code execution vulnerability in Windows Distributed File System (DFS) allows an attacker to execute arbitrary code remotely in the user context. Exploitation requires sending a specially crafted request to the DFS service.
A remote code execution vulnerability in Visual Studio allows an attacker to execute arbitrary code in the context of the logged-in user. Exploitation requires user interaction, such as opening a specially crafted project file.
Elevation of privilege vulnerability in Visual Studio. An attacker could exploit this flaw to gain elevated privileges on the system.
An improper authorization vulnerability in Fortinet FortiWebManager allows an unauthorized attacker to execute code or commands via HTTP requests or CLI. Affected versions: 7.2.0, 7.0.0-7.0.4, 6.3.0, 6.2.3-6.2.4, and 6.0.2.
In the Linux kernel, an uninit-value access vulnerability was found in __ip_make_skb(). The issue is caused by a race condition when checking the HDRINCL flag and missing initialization of fl4_icmp_type and fl4_icmp_code fields in the flowi4 structure.
W jądrze Linuxa zidentyfikowano podatność związaną z odczytem wskaźnika txq->read_ptr bez blokady. Może to prowadzić do podwójnego odczytu tej samej wartości, co skutkuje błędem WARN_ONCE() w późniejszym etapie.
In the Linux kernel, a vulnerability was found in the __ip6_make_skb() function for IPv6, involving potential uninitialized value access. The issue arises from incorrect checking of the HDRINCL flag on the socket, which can lead to a race condition and reading uninitialized data.
A command injection vulnerability was discovered in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228 in the UploadFirmwareFile function via the FileName parameter. An attacker can remotely execute arbitrary system commands.
A stack overflow vulnerability was discovered in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228. The issue occurs in the SetPortForwardRules function via the desc parameter.
A denial of service vulnerability in 389-ds-base LDAP server. An authenticated user may cause a server crash while modifying the `userPassword` attribute using malformed input.
In the Linux kernel, a slab-use-after-free vulnerability was found in the Bluetooth L2CAP subsystem's l2cap_connect() function. The issue arises from an insufficiently extended critical section, allowing premature freeing of the chan structure before use. The patch extends the critical section and changes the return type to void to prevent pointer leaks.
W jądrze Linuxa zidentyfikowano podatność, która dotyczy funkcji fiemap. Nie blokowanie inoda w trybie współdzielonym przed rozpoczęciem fiemap może prowadzić do zakleszczenia, gdy równocześnie wykonywana jest operacja fsync na pliku, co skutkuje błędem podczas dostępu do bufora przestrzeni użytkownika.
W jądrze Linuxa naprawiono podatność związaną z potencjalnym użyciem po zwolnieniu (UAF) w funkcji smb2_is_valid_oplock_break(). Problem ten występował w przypadku sesji, które były zamykane.