CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw has been found in Comfast CF-N1-S 2.6.0.1, affecting the function get_para_from_uri in /cgi-bin/mbox-config. Manipulation of width/height arguments causes stack-based buffer overflow. The attack can be initiated remotely.
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535, affecting the strcpy function in /goform/aspApBasicConfigUrcp. Manipulation of pvid leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306, affecting the strcpy function in /goform/formGroupConfig. Manipulation of timestart leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
A vulnerability was found in SPLWare esProc up to version 20260507, involving deserialization in the ObjectInputStream.readUnshared function in SocketData.java. Manipulation leads to unsafe deserialization, and the attack can be performed remotely.
A SQL injection vulnerability was found in code-projects Online Job Portal System 1.0 in the Password Recovery component, in the /ForPass.php file. Manipulation of the txtUserName argument allows SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.
A command injection vulnerability was found in TRENDnet Router version 1.1.02b01 in the /cgi-bin/ping.cgi file, in an unknown function. Manipulation of the wan_type argument causes command injection. The attack can be initiated remotely, and the exploit has been published.
The Speed Optimizer plugin for WordPress up to version 7.8.0 is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable only when the Lazy Load Media option is enabled.
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
A command injection vulnerability was found in TRENDnet TEW-823DRU router version 1.1.02b01 in the /cgi-bin/admin.cgi file. Manipulation of the Hostname argument results in command injection. The attack can be launched remotely, and the exploit is public.
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the execSqlText/previewSqlText functions in DesignerController.java (SQL Preview Endpoint). Manipulation of the sqlText argument results in improper neutralization of special elements used in a template engine, potentially allowing remote attack. The exploit has been made public, and the project has not responded.
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the DataSourceController.add function in DataSourceController.java (QueryerFactory component). Manipulation of the queryerClass argument leads to permission issues, potentially allowing remote attack. The exploit has been publicly disclosed, and the project has not responded.
A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01, affecting the strcpy function in /cgi-bin/wan.cgi. Manipulation of wan_l2tp_password leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress up to version 1.9.15 is vulnerable to unauthorized data access due to improper capability check on the can_access function. Authenticated attackers with Contributor-level access can retrieve a master-password and access any password-protected content.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.
CSRF vulnerability in HashBar – WordPress Notification Bar plugin. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.