CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
DVP-12SE11T - Password Protection Bypass
ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
W urządzeniu Tenda M3 w wersji 1.0.0.13(4903) odkryto lukę bezpieczeństwa, która dotyczy funkcji formSetAdInfoDetails w pliku /goform/setAdInfoDetail. Manipulacja argumentami takimi jak adName, smsPassword, smsAccount, weixinAccount, weixinName, smsSignature, adRedirectUrl, adCopyRight, smsContent oraz adItemUID prowadzi do przepełnienia bufora w stercie.
A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
W Tenda M3 w wersji 1.0.0.13(4903) zidentyfikowano podatność, która dotyczy funkcji formSetRemoteVlanInfo w pliku /goform/setVlanInfo. Manipulacja argumentem ID/vlan/port może prowadzić do przepełnienia bufora na stosie.
Wykryto podatność w urządzeniu Tenda M3 w wersji 1.0.0.13(4903). Problem dotyczy funkcji formSetVlanPolicy w pliku /goform/setVlanPolicyData, gdzie manipulacja argumentem qvlan_truck_port prowadzi do przepełnienia bufora w stercie.
A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient. Manipulation of the argument LISTLEN leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public.
A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early but did not respond.
The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.
The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.
A flaw was found in SohuTV CacheCloud up to version 3.2.0. It affects the index function in the file src/main/java/com/sohu/cache/web/controller/AppDataMigrateController.java. This manipulation causes cross-site scripting. Remote exploitation is possible. The exploit has been published and may be used. The project was informed but has not responded.
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public. The project was informed but has not responded.
In SohuTV CacheCloud up to 3.2.0, the doMachineList/doPodList functions in MachineManageController.java are vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
Zidentyfikowano słabość w urządzeniach Tenda AC10U w wersjach 15.03.06.48 oraz 15.03.06.49. W funkcji fromadvsetlanip w pliku /goform/AdvSetLanip, manipulacja argumentem lanMask może prowadzić do przepełnienia bufora.
W urządzeniu Tenda AC23 w wersji 16.03.07.52 odkryto lukę bezpieczeństwa w funkcji formSetPPTPUserList komponentu obsługi żądań HTTP POST. Manipulacja listą argumentów prowadzi do przepełnienia bufora, co może być wykorzystane przez atakującego zdalnie.
A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument bindnum leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49 affecting the formSetPPTPUserList function in the file /goform/setPptpUserList of the HTTP POST Request Handler component. Manipulation of the list argument causes a buffer overflow, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote and the exploit is public.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS