CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Tautulli versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious external image URL into this lookup table and trigger server-side fetches through an unauthenticated endpoint, turning an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget.
GNCC GP5 v7.1.76 uses a weak hashing algorithm to protect the root password. Attackers can perform a brute-force attack to obtain root credentials and escalate privileges.
MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.
An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07 and T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via a crafted HTTP query string.
T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the 'superadmin' account.
Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via a crafted request to a vulnerable CGI component.
An OS Command Injection vulnerability in the API of Progress ADC products allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Mobatek MobaXterm version 12.1 has a buffer overflow vulnerability in the username field of session files. A remote attacker can craft a malicious session file that, when imported and executed, triggers a buffer overflow and allows arbitrary code execution.
WordPress Hybrid Composer plugin version 1.4.6 contains an unauthenticated settings change vulnerability. An attacker can send a POST request to admin-ajax.php with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator.
PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information.
The WordPress plugin 'ad manager wd' version 1.0.11 contains an arbitrary file download vulnerability. An unauthenticated attacker can manipulate the 'path' parameter in GET requests to the edit.php endpoint with export=export_csv to read arbitrary files like wp-config.php.
Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass from 20210501 through 20260429.
The registration path /v1/account/register lacks bot mitigation mechanisms, allowing malicious automated systems to flood the database.
The /v1/Plan service uses a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
The production build of M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
The ai_cmd utility runs with full root permissions and pipes socket inputs directly to popen(), allowing unauthenticated users to execute arbitrary root commands.
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). Any client can subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
Vulnerability in FieldX MDM: the adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.