CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Technostrobe HI-LED-WR120-G2 device version 5.5.0.1R6.03.30 has a vulnerability in an unknown function of the /Technostrobe/ endpoint. Manipulation leads to improper access controls. The attack can be performed remotely, and the exploit has been made public. The vendor did not respond.
A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.
In Tenda M3 version 1.0.0.10, the function setAdvPolicyData in /goform/setAdvPolicyData is vulnerable to buffer overflow via manipulation of the argument policyType. The attack can be executed remotely, and the exploit is published.
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects the function strcpy in the file /goform/formNatStaticMap. Manipulation of the argument NatBind results in buffer overflow. Remote exploitation is possible, and the exploit is publicly available.
A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /delmemberinfo.php via the userid parameter. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /searchguest.php via the searchServiceId parameter. The attack can be performed remotely and the exploit is publicly available.
In provectus kafka-ui up to version 0.7.2, the function validateAccess in /api/smartfilters/testexecutions is vulnerable to code injection. The attack can be initiated remotely, and the exploit is publicly available. The vendor did not respond.
A SQL injection vulnerability was found in Concert Ticket Reservation System 1.0 in the file login.php via the Email parameter. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in Concert Ticket Reservation System 1.0 in the file process_search.php via the searching parameter. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in Free Hotel Reservation System 1.0 in the file /hotel/admin/login.php via the email parameter. The attack can be performed remotely and the exploit is publicly available.
A stack-based buffer overflow vulnerability was identified in the fromSysToolChangePwd function of the /bin/httpd file in Tenda AC10 firmware version 16.03.10.10_multi_TDE01. The attack can be initiated remotely and may affect multiple endpoints.
A stack-based buffer overflow vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01 in the function fromSysToolChangePwd of the file /bin/httpd. Manipulating the argument sys.userpass results in buffer overflow, and the attack can be initiated remotely.
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects an unknown function in the file /goform/formRemoteControl. Manipulation of the argument Profile results in stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
In code-projects Simple Laundry System 1.0, the /modifymember.php file in the Parameter Handler component is vulnerable to SQL injection via the firstName argument. Remote exploitation is possible and the exploit is public.
FedML-AI FedML up to version 0.8.9 contains a deserialization vulnerability in the sendMessage function of the grpc_server.py file in the gRPC server component. Remote attackers can perform manipulation leading to deserialization, potentially enabling arbitrary code execution.
A SQL injection vulnerability was found in Online Enrollment System 1.0 in the file /sms/user/index.php?view=edit&id=10 via the USERID parameter. The attack can be performed remotely and the exploit is publicly available.
Tenda 4G03 Pro up to version 1.0/1.1/04.03.01.53/192.168.0.1 contains an improper access control vulnerability in the /bin/httpd file. The attack can be performed remotely, and the exploit has been publicly released.
A denial of service vulnerability in MediaWiki 1.2.0 allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.
10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling (SEH) that allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application.
Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field. A local attacker can inject a malicious payload via the Netplay Options menu, overwriting the SEH structure and achieving code execution.