CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Plixer Scrutinizer 19.0.2 is affected by SQL Injection vulnerability. An attacker can remotely obtain sensitive information.
A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the kernel thread associated with queue 0, leading to a use-after-free when the backend is destroyed.
W MVISION EDR (MVEDR) przed wersją 3.4.0 występuje podatność na wstrzykiwanie poleceń, która pozwala uwierzytelnionemu administratorowi MVEDR na wywołanie klienta EDR do wykonania dowolnych poleceń za pomocą PowerShell poprzez funkcjonalność EDR 'wykonaj reakcję'.
PHPGurukul Hospital Management System v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated attackers can exploit it to obtain sensitive database information.
D-Link DIR-2640-US router version 1.01B04 has an incorrect access control vulnerability. When setting up PPPoE, it starts the Quagga process for whole network monitoring using default credentials and port. An attacker can easily log in via Telnet, modify routing, monitor all device traffic, hijack DNS, and perform phishing attacks.
D-Link DIR-2640-US router version 1.01B04 is vulnerable to buffer overflow. Multiple out-of-bounds vulnerabilities exist in some processes of the device. Local ordinary users can overwrite global variables in the .bss section, causing process crashes or changes.
Multiple out-of-bounds vulnerabilities were found in D-Link AC2600 (DIR-2640) firmware version 1.01B04. They allow privilege escalation from ordinary to administrator permissions, leading to local arbitrary code execution.
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
W urządzeniach PowerLogic EGX100 (wersje 3.0.0 i nowsze) oraz PowerLogic EGX300 (wszystkie wersje) występuje podatność CWE-20: Niewłaściwa walidacja danych wejściowych. Może ona prowadzić do odmowy usługi w wyniku specjalnie skonstruowanego pakietu HTTP.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
CSRF vulnerability in TP-Link TL-SG2005, TL-SG2008, etc. switches with firmware version 1.0.0 Build 20180529 Rel.40524. All configuration data is placed in the URL without any additional token authentication, allowing an attacker to use a malicious link to change the password and tamper with the configuration file.
TP-Link TL-SG2005, TL-SG2008, etc. running firmware version 1.0.0 Build 20180529 Rel.40524 are affected by an array index error. The interface providing the "device description" function only checks the length of received data without filtering special characters. This vulnerability causes the application to crash and erases all device configuration information.
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables.
Windows MSHTML Platform Remote Code Execution Vulnerability. Technical details are not provided in the description.
Microsoft DWM Core Library Elevation of Privilege Vulnerability. Technical details are not provided in the description.
Windows NTFS Elevation of Privilege Vulnerability. Technical details are not provided in the description.
A remote code execution vulnerability in Windows Print Spooler allows an attacker to execute arbitrary code with system privileges.
Podatność CVE-2021-32926 pozwala atakującemu na przechwycenie żądania zmiany hasła przez uwierzytelnionego użytkownika i zastąpienie go nielegalnym hashem. W wyniku tego użytkownik nie będzie mógł się uwierzytelnić w kontrolerze, co prowadzi do stanu odmowy usługi.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS