CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
A flaw has been found in Tenda CP3 (version 27.5.57.101) in the CAutoAddWifi::ThreadProc function of the Functions/AutoAddWifi.cpp file in the Kylin component. Executing a manipulation can lead to OS command injection. The attack may be launched remotely.
A vulnerability was detected in Tenda CP3 (version 27.5.57.101) in the sub_2F77E8 function of the Apis/system.c file in the Network Configuration Management component. Performing a manipulation results in OS command injection. The attack may be initiated remotely.
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority. This means the identifier is no longer valid and should not be used for vulnerability tracking.
A vulnerability has been identified in Tenda CP3 27.5.57.101 in the file Net/NetCheckPing.cpp. Manipulation of the interface_name/host arguments causes OS command injection. The attack can be initiated remotely.
A vulnerability has been discovered in Tenda CP3 27.5.57.101 in the SystemAsh function of the file Apis/system.c of the Kylin component. Manipulation of the AlarmVoiceURL argument results in OS command injection. The attack can be launched remotely.
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4.
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
MikroTik RouterOS (7.x) accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because the trust store includes an e=3 root CA, an attacker controlling or redirecting outbound TLS can use the root's public certificate to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. This also undermines RSA-based SSH authentication.
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs.
The libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.
The libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
The libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
The libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS