CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setIpQosRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been released to the public.
The Essential Addons for Elementor WordPress plugin before version 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
The Paymob for WooCommerce plugin before version 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.
A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. The function set_wl_guest_iplist in /goform/WifiGuestSet of the httpd web management interface is affected. Manipulating the argument shareSpeed causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. The function set_device_name in /goform/SetOnlineDevName of the httpd web management interface is affected. Manipulating the argument devName results in stack-based buffer overflow. The attack may be launched remotely, and the exploit has been made public.
The W3 Total Cache plugin for WordPress up to version 2.10.3 is vulnerable to Stored Cross-Site Scripting via Comment Author Name due to insufficient input sanitization and output escaping. The vulnerability is only exploitable when the Lazy Load Images feature is enabled, as the unsafe re-emission occurs exclusively within the LazyLoad mutator's img tag rewriting step.
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA in the LuCI Web Interface component, specifically in the file /cgi-bin/luci. Manipulation of the arguments MaxHops/Timeout/Size leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5 in the file /app/users/getpwd.php. Manipulation of the argument sip leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
A vulnerability was determined in dromara lamp-cloud up to version 5.10.0 in the file FileChunkController.java of the chunk-check endpoint component. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
A vulnerability was found in Dromara lamp-cloud up to version 5.10.0 in the file FileAnyoneController.java of the File-Upload Controller component. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely, and the exploit has been made public.
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
OpenChoreo up to version 1.2.0 has a vulnerability where authorization for commands and wirelogs uses the caller-supplied project parameter instead of the actual component owner. A user with project-scoped grants can execute commands and read wirelogs in components of other projects in the same namespace.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.
FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.
FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.