CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reachable assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with NRF connectivity to cause denial of service. By sending creation of an NF with invalid type via SBI and then requesting its data, the NRF executes a check that crashes the process, leaving discovery service unresponsive.
Reachable assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that crashes the NRF process and makes the discovery service unavailable.
A vulnerability in code-projects Client Details System 1.0, affecting unknown code in the file /welcome.php. Such manipulation leads to cross-site scripting (XSS). The attack may be performed remotely. The exploit has been disclosed publicly.
W systemie Abdullah-Hasan-Sajjad Online-School do wersji f09dda77b4c29aa083ff57f4b1eb991b98b68883 zidentyfikowano lukę w pliku /studentLogin.php. Manipulacja argumentem Email prowadzi do podatności na atak typu SQL injection, który może być przeprowadzony zdalnie.
A buffer overflow vulnerability was detected in Tenda CH22 in the fromP2pListFilter function of /goform/P2pListFilter, caused by manipulation of the page argument. Remote exploitation is possible, and the exploit has been publicly disclosed.
Zidentyfikowano słabość w urządzeniu Tenda CH22 w wersji 1.0.0.1. W funkcji fromwebExcptypemanFilter w pliku /goform/webExcptypemanFilter manipulacja argumentem page może prowadzić do przepełnienia bufora.
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.
W urządzeniu Tenda CH22 w wersji 1.0.0.1 odkryto lukę bezpieczeństwa, która wpływa na funkcję fromAddressNat w pliku /goform/addressNat. Manipulacja argumentem page prowadzi do przepełnienia bufora, co może być wykorzystane w atakach zdalnych.
A buffer overflow vulnerability was identified in Tenda CH22 in the fromRouteStatic function of /goform/RouteStatic, caused by manipulation of the page argument. The attack can be launched remotely, and the exploit is publicly available.
An incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.
An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.
A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.
An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.
A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to version 20251009. The function _empty of the file /index.php/auth/widget is affected. Manipulation of arguments get.layer/get.widget/get.action results in code injection. The attack can be performed remotely, and the exploit is public.
Zidentyfikowano słabość w urządzeniu Tenda CH22 w wersji 1.0.0.1, która dotyczy funkcji fromVirtualSer w pliku /goform/VirtualSer. Manipulacja argumentem page prowadzi do przepełnienia bufora, co umożliwia zdalne wykorzystanie tej podatności.
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS