CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used.
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used.
CTI-Transmute has a cross-site request forgery (CSRF) vulnerability in the user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests, allowing an unauthenticated attacker to trick an administrator into deleting an account without consent.
CTI-Transmute has an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The days parameter was not restricted to a reasonable range, allowing an attacker to overload the system.
CTI-Transmute is vulnerable to a server-side request forgery in the PDF report generation. User-controlled content can inject resource references (http, https, file) that the server fetches during rendering.
eParakstītājs 3.0 for Windows before version 1.10.0 fetches updates over an insecure channel. It accepts any TLS certificate and does not verify digital signatures or checksums.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
In NR modem, there is a possible improper input validation, which could lead to remote denial of service, requiring system execution privileges.
Synology Assistant before version 7.0.7-50095 has incorrect default permissions. A local user can read or write arbitrary files and perform a denial-of-service attack during installation.
In the Wavlink WL-NU516U1 (version 708c073-mt7628), the config import function does not sanitize the Password argument, allowing remote OS command injection. The attack is complex but an exploit has been published.
The LogMyTrip WordPress plugin through 1.9 does not sanitize or escape a cookie value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on pages with the plugin's shortcodes.
The 'sm page duplicator' WordPress plugin through version 1.0.0 does not sanitize or escape a stored value before using it in a SQL statement when duplicating a page, allowing users with Editor role and above to perform SQL Injection attacks.
The ChamaWP WordPress plugin before version 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.