CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a concurrent execution issue in Windows Win32K - GRFX due to improper synchronization, leading to a race condition. This allows an authorized attacker to elevate privileges locally.
W systemie Windows Win32K - GRFX występuje problem z równoległym wykonywaniem przy użyciu współdzielonych zasobów z niewłaściwą synchronizacją, co prowadzi do wystąpienia warunku wyścigu. Umożliwia to autoryzowanemu atakującemu lokalne podniesienie uprawnień.
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
A use after free vulnerability in Windows Win32K allows an authorized attacker to elevate privileges locally.
A race condition in Windows Win32K allows an authorized attacker to locally elevate privileges due to improper synchronization during concurrent execution using shared resources.
CVE-2026-33838 is a vulnerability related to double free in Windows Message Queuing, allowing an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
Improper neutralization of special elements in output used by a downstream component in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
The Azure Monitor Agent has a vulnerability related to external control of file name or path, allowing an authorized attacker to elevate privileges locally.
A heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
A race condition in the Windows Native WiFi Miniport Driver allows concurrent execution using shared resources with improper synchronization.
The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records are exposed without any verification of the requester's identity or permissions.
The CosyVoice project contains an insecure deserialization vulnerability in its model loading process. This allows an attacker to execute malicious code on the victim's system by loading a specially crafted model directory.
Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 may allow an escalation of privilege. An unprivileged software adversary with authenticated access can perform a low complexity attack leading to privilege escalation.