CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Spoofing vulnerability in Visual Studio Code. An attacker could impersonate a trusted source, potentially leading to display of false information or tricking users into performing unwanted actions.
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.
Spoofing vulnerability in Microsoft Edge for iOS. Could allow an attacker to impersonate trusted websites.
Spoofing vulnerability in Microsoft Edge for Android. Allows an attacker to impersonate trusted content.
Elevation of Privilege vulnerability in Microsoft Edge (Chromium-based). Could allow an attacker to gain elevated privileges.
Information disclosure vulnerability in Microsoft Edge for Android. Could allow access to sensitive data.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based). An attacker could exploit this flaw to gain elevated privileges on the system.
Podatność CVE-2021-22791 dotyczy błędu zapisu poza granicami (CWE-787) w kontrolerach Modicon PLC, który może prowadzić do awarii usługi podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC.
Podatność CWE-125: Odczyt poza zakresem, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum oraz symulatorów PLC dla EcoStruxure.
Występuje podatność CWE-119: Niewłaściwe ograniczenie operacji w granicach bufora pamięci, która może spowodować Denial of Service na kontrolerze/symulatorze Modicon PLC podczas aktualizacji aplikacji kontrolera za pomocą specjalnie przygotowanego pliku projektu. Dotyczy to różnych modeli kontrolerów Modicon M580, M340, MC80, Momentum Ethernet, Quantum oraz Premium, a także symulatorów PLC dla EcoStruxure.
WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background, allowing attackers to steal cookies via a crafted payload in the search box.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based). An attacker could exploit this flaw to gain elevated privileges on the system.
Information disclosure vulnerability in Microsoft Edge (Chromium-based). It could allow an attacker to access information that should not be disclosed.
A vulnerability in Microsoft Edge (Chromium-based) allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges in the browser context.
XStream, a library for serializing objects to and from XML, in affected versions may allow a remote attacker to allocate 100% CPU time on the target system by manipulating the processed input stream, resulting in a denial of service. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected.
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. This can lead to a crash of the KDC service.
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. The vulnerability affects Intel processors.
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows injection of malicious script into the application.
Cross-site scripting (XSS) vulnerability in Microsoft Dynamics Business Central. Allows injection of malicious script into the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS