CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang results in stack-based buffer overflow. The attack can be launched remotely, and the exploit is now public.
A buffer overflow vulnerability was detected in TOTOLINK A3300R in the setDmzCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the ip argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
A buffer overflow vulnerability was identified in TOTOLINK A3300R in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. The attack may be performed remotely, and the exploit has been made publicly available.
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Zidentyfikowano podatność w systemie zarządzania biblioteką Advanced Library Management System w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /index.php, gdzie manipulacja argumentem keywords prowadzi do wstrzyknięcia SQL.
W Tenda CH22 w wersji 1.0.0.1 zidentyfikowano podatność, która dotyczy funkcji fromDhcpListClient w pliku /goform/DhcpListClient. Manipulacja argumentem page prowadzi do przepełnienia bufora, co umożliwia zdalne wykorzystanie tej podatności.
W Tenda CH22 w wersji 1.0.0.1 odkryto podatność, która dotyczy funkcji fromSetIpBind w pliku /goform/SetIpBind. Manipulacja argumentem page prowadzi do przepełnienia bufora.
A vulnerability has been found in Tenda CH22 1.0.0.1 affecting the fromSafeMacFilter function in the file /goform/SafeMacFilter. Manipulation of the page argument leads to a buffer overflow, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
W urządzeniu Tenda CH22 w wersji 1.0.0.1 znaleziono lukę, która dotyczy funkcji fromSafeUrlFilter w pliku /goform/SafeUrlFilter. Manipulacja argumentem 'page' może prowadzić do przepełnienia bufora, co umożliwia zdalne przeprowadzenie ataku.
Wykryto podatność w urządzeniu Tenda CH22 w wersji 1.0.0.1, która dotyczy funkcji fromSafeClientFilter w pliku /goform/SafeClientFilter. Manipulacja argumentem page prowadzi do przepełnienia bufora, co może być wykorzystane przez zdalnego atakującego.
HYDRA X, MIP 2 i FEDRA 2 firmy MPDV Mikrolab GmbH mają podatność na ujawnienie lokalnych plików bez uwierzytelnienia we wszystkich wersjach do Maintenance Pack 36 z Servicepack 8 (tydzień 36/2025). Umożliwia to atakującemu odczyt dowolnych plików z systemu operacyjnego Windows.
A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.
A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.
A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.
A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.
A cross site scripting vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. The attack can be executed remotely and the exploit has been publicly disclosed.
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
A SQL injection vulnerability was found in the save_house function of /admin_class.php in SourceCodester Best House Rental Management System 1.0. Manipulation of the house_no argument allows SQL injection. The vulnerability can be exploited remotely and a public exploit exists.
A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit has been disclosed to the public.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS