CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
CVE-2026-44184 affects the Cleanuparr tool, which automates the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients. In versions prior to 2.9.10, the global CORS policy allowed reflecting every request Origin, enabling access to authenticated API responses from other websites.
The phpseclib library for secure communications in PHP prior to versions 1.0.29, 2.0.54, and 3.0.52 allowed loading untrusted ASN1 files, which is a bypass of vulnerability CVE-2024-27355.
Pocketbase, an open source web backend, has a vulnerability that allows an attacker to create and link an unverified user if they know the victim's email address. When the victim is invited to the app, the user created by the attacker will be automatically linked and verified.
The ssrfcheck library in versions 1.3.0 and earlier fails to block Server-Side Request Forgery (SSRF) attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address. The URL parser built into Node.js normalizes the IPv4 notation, causing the regex to miss the threat.
AntSword is a cross-platform website management toolkit. Prior to version 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection.
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
A vulnerability in ASP.NET Core causes an infinite loop, which can be exploited by an unauthorized attacker to perform a Denial of Service (DoS) attack over the network.
Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
M365 Copilot has improper neutralization of special elements used in commands, leading to a 'command injection' vulnerability. This allows an unauthorized attacker to perform tampering over a network.
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
A 'use after free' vulnerability in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Xibo is an open source digital signage platform that prior to version 4.4.1 had a Server-Side Request Forgery (SSRF) vulnerability. This allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to network resources.
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
A vulnerability in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network using session fixation.