CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.24)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
A null pointer dereference vulnerability in Microsoft Remote Registry Service allows an authorized attacker to cause a denial of service over the network.
Use of an uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Use of an uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
No CWE for this issue in AMD Zen allows an authorized attacker to disclose information locally.
No CWE for this issue in AMD Zen allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.
CAI Content Credentials is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.