CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Cockpit w wersji 2.13.5 i wcześniejszych jest podatny na wykonanie dowolnego kodu poprzez parametr filter w wielu punktach końcowych. Ta podatność umożliwia atakującemu uruchamianie poleceń systemowych na infrastrukturze bazowej za pomocą operatora $func MongoLite.
W urządzeniu TOTOLINK N200RE V5 odkryto podatność na wstrzykiwanie poleceń poprzez parametry macstr i bandstr w funkcji formMapDelDevice.
Jenkins GitHub Plugin version 1.46.0 and earlier improperly processes the current job URL in JavaScript, leading to a stored XSS vulnerability. Attackers with Overall/Read permissions can exploit this flaw.
Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker-controlled HTTP response headers. The application constructs local file paths using values derived from HTTP headers without validation, allowing attackers to write files outside the intended update staging directory.
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success, allowing attacker-supplied executables to be accepted and later executed by the application.
MegaCMS version 12.0.0 has an SQL injection (SQLi) vulnerability in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The issue arises from inadequate validation and sanitization of user input.
Google Chrome prior to version 147.0.7727.138 has a use-after-free vulnerability in the GPU component. A remote attacker can potentially escape the browser sandbox via a crafted HTML page.
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.
OpenClaw before version 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.
The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.
The NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system that allows an unauthenticated attacker to bypass authorization through a user-controlled key. Successful exploitation of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
Podatność CVE-2026-41873 dotyczy niekonsekwentnej interpretacji żądań HTTP w Pony Mail, co może prowadzić do przejęcia konta administratora. Problem ten występuje we wszystkich wersjach implementacji Lua Pony Mail, która została wycofana.
Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.
CVE-2026-7321 is a vulnerability related to incorrect boundary conditions in the WebRTC networking component, leading to a sandbox escape.
Wykryto podatność w urządzeniu D-Link DI-8100 w wersji 16.07.26A1, która dotyczy funkcji tgfile_htm w pliku tgfile.htm komponentu CGI Endpoint. Manipulacja argumentem fn prowadzi do przepełnienia bufora, co może być wykorzystane zdalnie.
W urządzeniu Totolink A8000RU w wersji 7.1cu.643_b20200521 odkryto lukę bezpieczeństwa. Problem dotyczy funkcji setWiFiEasyGuestCfg w pliku /cgi-bin/cstecgi.cgi, która umożliwia wstrzyknięcie poleceń systemowych poprzez manipulację argumentem merge.
Zidentyfikowano podatność w urządzeniu Totolink A8000RU w wersji 7.1cu.643_b20200521. Problem dotyczy funkcji setRadvdCfg w pliku /cgi-bin/cstecgi.cgi, gdzie manipulacja argumentem maxRtrAdvInterval prowadzi do wstrzyknięcia poleceń systemowych.
W Totolink A8000RU w wersji 7.1cu.643_b20200521 zidentyfikowano podatność w funkcji setOpenVpnClientCfg w pliku /cgi-bin/cstecgi.cgi. Manipulacja argumentem 'enabled' może prowadzić do wstrzyknięcia poleceń systemowych, co może być przeprowadzone zdalnie.
Wykryto podatność w urządzeniu Totolink A8000RU w wersji 7.1cu.643_b20200521, która dotyczy funkcji setWiFiBasicCfg w pliku /cgi-bin/cstecgi.cgi komponentu CGI Handler. Manipulacja argumentem wifiOff prowadzi do zdalnej iniekcji poleceń systemowych.