CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Totolink A8000RU web management interface, the setOpenVpnCertGenerationCfg function is vulnerable to OS command injection via the servername argument.
A vulnerability has been found in the Totolink A8000RU router version 7.1cu.643_b20200521, allowing OS command injection via the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi by manipulating the enable argument. The attack can be executed remotely, and an exploit has been published.
A vulnerability was detected in the web management interface of Totolink A8000RU router, allowing OS command injection. The issue is in the setQosCfg function of /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be performed remotely and the exploit is publicly available.
A security vulnerability was found in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setWiFiWpsCfg function in /cgi-bin/cstecgi.cgi, where the wscDisabled argument is mishandled. The attack can be launched remotely and the exploit is public.
A weakness was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setMacFilterRules function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be initiated remotely and the exploit is public.
A security flaw was discovered in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setWiFiAdvancedCfg function in /cgi-bin/cstecgi.cgi, where the bgProtection argument is mishandled. The attack can be launched remotely and the exploit is public.
A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.
A vulnerability was detected in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setStaticDhcpRules function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be performed remotely and the exploit is public.
A security vulnerability was found in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setFirewallType function in /cgi-bin/cstecgi.cgi, where the firewallType argument is mishandled. The attack can be launched remotely and the exploit is public.
A weakness was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setRemoteCfg function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be initiated remotely and the exploit is public.
A security flaw was discovered in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setGameSpeedCfg function in /cgi-bin/cstecgi.cgi, where the enable argument is mishandled. The attack can be launched remotely and the exploit is public.
A vulnerability was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setDdnsCfg function in /cgi-bin/cstecgi.cgi, where the provider argument is not properly sanitized. The attack can be performed remotely and the exploit is public.
A vulnerability in the Totolink A8000RU router version 7.1cu.643_b20200521 allows a remote attacker to inject OS commands via the mode argument in the setScheduleCfg function of the web management interface.
A security flaw was discovered in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setUpgradeFW function in /cgi-bin/cstecgi.cgi, where the resetFlags argument is mishandled. The attack can be launched remotely and the exploit is public.
A vulnerability was identified in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setLanguageCfg function in /cgi-bin/cstecgi.cgi mishandles the lang argument, allowing remote OS command injection.
A vulnerability was found in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setTracerouteCfg function in /cgi-bin/cstecgi.cgi improperly validates the command argument, enabling remote OS command injection.
A vulnerability was discovered in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setDiagnosisCfg function in /cgi-bin/cstecgi.cgi fails to properly sanitize the ip argument, allowing remote OS command injection.
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
userSpice 4.3.24 has a username enumeration vulnerability. An unauthenticated attacker can send POST requests to existingUsernameCheck.php and analyze responses to find existing accounts.
Improper authentication vulnerability in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.