CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ConnectWise Automate Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. The attacker must first obtain the ability to execute low-privileged code.
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-45206 but in a different process protection communication mechanism. The attacker must first obtain the ability to execute low-privileged code.
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-45207 but in a different process protection communication mechanism. The attacker must first obtain the ability to execute low-privileged code.
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-34927 but in a different process protection mechanism. The attacker must first obtain the ability to execute low-privileged code.
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. The attacker must first obtain the ability to execute low-privileged code.
An origin validation vulnerability in the Apex One/SEP agent allows a local attacker to escalate privileges via a named pipe communication mechanism. The attacker must first obtain low-privileged code execution.
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. The attacker must first obtain the ability to execute low-privileged code.
Authenticated remote code execution vulnerability in Zohocorp ManageEngine products: ADSelfService Plus before 6525, DataSecurity Plus before 6264, and RecoveryManager Plus before 6313. Caused by a bug in a third-party dependency.
An origin validation error in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges. The attacker must first execute low-privileged code.
Time-of-check time-of-use vulnerability in Trend Micro Apex One (Mac) agent cache mechanism allows local attacker to escalate privileges. Requires prior low-privileged code execution. Patches available in ActiveUpdate/SaaS updates from mid/late 2025.
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges. The attacker must first execute low-privileged code.
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system.
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.
Trend Micro Apex One has a link following vulnerability in the scan engine that could allow a local attacker to escalate privileges. The attacker must first have the ability to execute low-privileged code.
Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu through 21052026. The vendor did not respond.
Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass.
Apache Camel K has a vulnerability involving an externally controlled reference to a resource in another sphere and authorization bypass through a user-controlled key. Authorized users in a Kubernetes namespace can create a Build resource, controlling Pod generation in a namespace of their choice, including the operator namespace.
In the Linux kernel's net/rds subsystem, there is an issue with zerocopy send cleanup before the message is queued. Incorrect zerocopy state discrimination can lead to improper cleanup of user pages.
In the Linux kernel, the remove_waiter() function in rtmutex uses current instead of waiter::task, causing issues during proxy-lock rollback in rt_mutex_start_proxy_lock() called from futex_requeue(). This leads to missing pi_lock, uncleared pi_blocked_on state (UAF risk), and incorrect rt_mutex_adjust_prio_chain() behavior.