CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Type confusion in V8 in Google Chrome prior to version 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A SQL injection vulnerability has been found in the MOVEit Transfer web application before version 2021.0.6, which could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
In RocketMQ versions 5.1.0 and below, there is a risk of remote command execution under certain conditions. Several components of RocketMQ, including NameServer, Broker, and Controller, are exposed on the extranet and lack permission verification.
CVE-2023-33010 describes a buffer overflow vulnerability in the ID processing function in the firmware of Zyxel ATP series, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-33009 describes a buffer overflow vulnerability in the notification function in the firmware of Zyxel ATP series, USG FLEX series, USG20(W)-VPN, VPN series, and ZyWALL/USG series. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL.
Windows Graphics Component Remote Code Execution Vulnerability. Details are not provided in the description, but it allows remote code execution.
Windows Common Log File System Driver Elevation of Privilege Vulnerability.
Microsoft Publisher Security Feature Bypass Vulnerability. Details are not provided in the description, but it allows an attacker to bypass security features.
Podatność w Microsoft Exchange Server umożliwia zdalne wykonanie kodu. Atakujący może wykorzystać tę lukę do przejęcia kontroli nad systemem.
Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Remote code execution vulnerability in multiple Zoho ManageEngine on-premise products due to Apache Santuario xmlsec 1.4.1, where XSLT features are not properly secured. Exploitation only possible if SAML SSO has been configured.
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. There have been reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Removing an XSLT parameter during processing could have led to an exploitable use-after-free. There have been reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
A remote code execution vulnerability in Windows Scripting Languages.
Elevation of privilege vulnerability in Windows CNG Key Isolation Service. An attacker could exploit it to gain elevated privileges.
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
Elevation of privilege vulnerability in Microsoft Exchange Server. Allows an attacker to elevate their privileges in the system.
Elevation of privilege vulnerability in Windows Print Spooler. An attacker could exploit it to gain elevated privileges.
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.