CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser. User interaction is required – the victim must visit a crafted webpage.
An improper input validation vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
XSS vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
XSS vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Visual Studio Code contains a relative path traversal vulnerability that allows an unauthorized attacker to perform tampering over a network.
A vulnerability in Visual Studio Code allows an unauthorized attacker to disclose sensitive information over a network.
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Microsoft Bing has a UI misrepresentation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Microsoft Defender for Endpoint has a time-of-check time-of-use (TOCTOU) race condition vulnerability. An authorized attacker can elevate privileges locally.
Out-of-bounds read vulnerability in Windows DHCP Server allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.
Out-of-bounds read vulnerability in Microsoft UxTheme Library (uxtheme.dll). Allows an authorized attacker to cause a local denial of service.
Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
A protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
Server-side request forgery (SSRF) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS