CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint '/projects/hospital/admin/complaints.php' through the 'id' parameter.
Wersje MLFlow do łącznie 3.4.0 są podatne na ataki DNS rebinding z powodu braku walidacji nagłówka Origin w serwerze REST MLFlow. Ta podatność umożliwia złośliwym stronom internetowym obejście ochrony polityki Same-Origin i wykonywanie nieautoryzowanych wywołań do punktów końcowych REST.
Niektóre modele kamer IP opracowane przez Merit LILIN mają podatność na wstrzykiwanie poleceń systemowych, co pozwala uwierzytelnionym zdalnym atakującym na wstrzykiwanie dowolnych poleceń systemowych i ich wykonywanie na urządzeniu.
Niektóre modele DVR/NVR opracowane przez Merit LILIN mają podatność na wstrzykiwanie poleceń systemowych, co pozwala uwierzytelnionym zdalnym atakującym na wstrzykiwanie dowolnych poleceń systemowych i ich wykonywanie na urządzeniu.
Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection. This issue affects DX NetOps Spectrum: 24.3.13 and earlier.
Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation. This issue affects DX NetOps Spectrum: 24.3.10 and earlier.
Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass. This issue affects DX NetOps Spectrum: 24.3.10 and earlier.
CVE-2025-69272 is a vulnerability in Broadcom DX NetOps Spectrum that allows sniffing attacks due to cleartext transmission of sensitive information. It affects versions 21.2.1 and earlier on Windows and Linux.
Broadcom DX NetOps Spectrum versions 24.3.13 and earlier contain a vulnerability due to insufficiently protected credentials, allowing sniffing attacks on Windows and Linux systems.
W projekcie Online Music Site 1.0 odkryto lukę bezpieczeństwa, która dotyczy nieznanej funkcji w pliku /Administrator/PHP/AdminUpdateUser.php. Manipulacja argumentem ID prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.
Zidentyfikowano podatność w projekcie Online Music Site w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /Administrator/PHP/AdminAddUser.php, gdzie manipulacja argumentem txtusername prowadzi do wstrzykiwania SQL.
Missing XML validation in Apache Struts allows XML External Entity (XXE) attacks or other XML data manipulation. The vulnerability affects versions from 2.0.0 up to and including 6.1.0.
A vulnerability was detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formPictureUrl, where manipulation of the importpictureurl argument leads to buffer overflow. The attack can be launched remotely, and the exploit is now public.
A security vulnerability has been detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formConfigNoticeConfig, where the timestart argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
A vulnerability has been identified in UTT 进取 520W version 1.7.7-180627, involving the strcpy function in the /goform/APSecurity file. Manipulating the wepkey1 argument can lead to a buffer overflow. The attack can be performed remotely, and a public exploit increases the risk of exploitation.
A security flaw has been discovered in UTT 进取 520W version 1.7.7-180627, affecting the strcpy function in the /goform/ConfigWirelessBase file. Manipulation of the ssid argument results in a buffer overflow. The attack can be carried out remotely, and a public exploit increases the risk of exploitation.
A vulnerability was identified in UTT 进取 520W version 1.7.7-180627 in the strcpy function of the file /goform/formFireWall. Manipulation of the GroupName argument leads to a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
A vulnerability was found in UTT 进取 520W version 1.7.7-180627, involving a buffer overflow in the strcpy function in the file /goform/formConfigFastDirectionW. Manipulation of the ssid argument causes the overflow, which can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded.
W podatności w quickjs-ng quickjs do wersji 0.11.0 zidentyfikowano problem w funkcji js_typed_array_constructor w pliku quickjs.c. Wykonanie manipulacji może prowadzić do przepełnienia bufora w stercie.
A vulnerability in Apache NimBLE allows authentication bypass via spoofing. Receiving a specially crafted Security Request can lead to removal of the original bond and re-bonding with an impostor. The issue affects versions up to and including 1.8.0.