CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow or wraparound in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
Race condition vulnerability in Remote Desktop Client. An unauthorized attacker can execute code remotely by exploiting concurrent access to a shared resource.
A race condition in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Out-of-bounds write vulnerability in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.
Remote Desktop Client has a race condition vulnerability in concurrent execution using a shared resource. An unauthorized attacker can execute code remotely.
Windows RDP contains an out-of-bounds read vulnerability that allows an unauthorized attacker to disclose information over a network.
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Improper authorization vulnerability in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
A race condition in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Improper access control vulnerability in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally.
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
OpenSSL has a NULL pointer dereference vulnerability when OCSP response checking for the whole chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) are enabled. If the chain lacks a self-signed trusted anchor, a NULL dereference crashes the process.
Vulnerability in OpenSSL QUIC server. Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference when address validation is disabled, causing abnormal termination of the QUIC server process and denial of service. By default, address validation is enabled, so the default configuration is not vulnerable.
The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.
Svelte framework versions 5.51.5 through 5.55.6 have a ReDoS vulnerability in <svelte:element this={tag}></svelte:element>. An internal regex can take exponential time to test.
Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.
A cross-site scripting (XSS) vulnerability in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.