CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability causes memory corruption during PlayReady APP usecase while processing TA commands.
A transient DOS may occur while processing an IOCTL call for image encoding. The vulnerability affects the image encoding mechanism.
The vulnerability causes memory corruption while processing camera platform driver IOCTL calls.
Information disclosure while processing batch command execution in Video driver.
A transient DOS may occur while processing video packets received from video firmware. The vulnerability affects video packet processing.
Information disclosure may occur while processing the hypervisor log. The vulnerability concerns logs generated by the hypervisor.
Memory corruption may occur while processing an IOCTL call for a DMM/WARPNCC CONFIG request. The vulnerability affects handling of DMM/WARPNCC configuration requests.
A SQL injection vulnerability was identified in Online Complaint Site 1.0 in /cms/admin/state.php. Manipulation of the state argument allows remote SQL injection. The exploit is public.
W systemie ChurchCRM do wersji 5.18.0 odkryto lukę bezpieczeństwa w funkcji AuthMiddleware, która znajduje się w pliku src/ChurchCRM/Slim/Middleware/AuthMiddleware.php. Manipulacja tą funkcją prowadzi do braku autoryzacji, co umożliwia zdalne przeprowadzenie ataku.
A vulnerability was identified in Tenda AC7 (version 15.03.06.44). It affects an unknown function of the file /goform/saveAutoQos. Manipulation of the enable argument leads to a stack-based buffer overflow. Remote exploitation is possible, and the exploit is publicly available.
W podatności CVE-2025-11527 zidentyfikowano problem w urządzeniu Tenda AC7 w wersji 15.03.06.44. Nieznana funkcja w pliku /goform/fast_setting_pppoe_set może prowadzić do przepełnienia bufora na stosie w wyniku manipulacji argumentem Password.
W Tenda AC7 w wersji 15.03.06.44 odkryto podatność, która występuje w nieznanej funkcji pliku /goform/WifiMacFilterSet. Manipulacja argumentem wifi_chkHz prowadzi do przepełnienia bufora na stosie.
A vulnerability in Tenda AC7 router (version 15.03.06.44) affects an unknown function in the /goform/SetUpnpCfg file. Manipulation of the upnpEn argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
A flaw in Tenda AC7 router (version 15.03.06.44) affects some unknown processing of the /goform/SetDDNSCfg file. Manipulation of the ddnsEn argument causes a stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been published.
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback.
Wtyczka Community Events dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'event_venue' we wszystkich wersjach do i włącznie z 1.5.1. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
Wtyczka Cookie Notice & Consent dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez parametr uuid we wszystkich wersjach do 1.6.5 włącznie, z powodu niewystarczającej sanitizacji wejścia i ucieczki wyjścia. Umożliwia to nieautoryzowanym atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które będą wykonywane, gdy użytkownik uzyska dostęp do zainfekowanej strony.
A SQL injection vulnerability was identified in Online Complaint Site 1.0 in /cms/users/complaint-details.php. Manipulation of the cid argument allows remote SQL injection. The exploit is public.
A SQL injection vulnerability was discovered in Online Complaint Site 1.0 in /cms/users/register-complaint.php. Manipulation of the cid argument allows remote SQL injection. The exploit is public.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS