CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
A vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network via '.../...//'.
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
Modification of assumed-immutable data (MAID) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
A vulnerability in Dinky allows an unauthenticated attacker to write arbitrary files on the server via the /download/uploadFromRsByLocal endpoint. Lack of path validation and a hardcoded default token enable overwriting application files and executing code as the Dinky service account.
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints.
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module, allowing a remote attacker to execute arbitrary code.
A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.
An authentication issue was addressed with improved state management. This issue affects macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, and macOS Tahoe 26.6.1. A network attacker may be able to authenticate to Screen Sharing without valid credentials.
A vulnerability in Ground Station (before 0.6.0) allows unauthenticated attackers to destroy or replace the entire SQLite database by sending a full_restore command to the Socket.IO server on port 7000. Lack of authentication and wildcard CORS policy enable remote exploitation.
Prior to version 1.0.4, OpenReception's appointment booking software allowed unauthenticated attackers to store attacker-controlled ML-KEM-768 public keys for any tenant without authentication. The POST /api/tenants/{tenantId}/staff/{staffId}/crypto route logged a warning but still inserted the row, and a variant with omitted email field suppressed the warning entirely. This breaks the end-to-end encryption claim, as the attacker becomes an additional encryption recipient for future patient appointments.