CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.
A heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code remotely over a network.
Vulnerability in Microsoft Dynamics NAV involving deserialization of untrusted data, allowing an unauthorized attacker to execute code remotely over the network.
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
Minecraft Bedrock Dedicated Server has a heap-based buffer overflow. An unauthenticated attacker can execute code remotely on the server.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code remotely over a network.
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
A vulnerability in the Mojolicious library for Perl (versions 4.59 through 9.48) exposes a stable CSRF token representation to a BREACH compression oracle. The token is generated once per session and placed in a hidden `csrf_token` field, and when the response echoes attacker-controlled input and is gzip-compressed, the token can be recovered.
In sigstore-js prior to version 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key.
A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS