CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow in the inet_ntoa() function via the param_2 parameter.
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow vulnerability in the FUN_0000acb4 function via the param_2 parameter.
D-Link DIR-842 with firmware version fw_revA_1-02_eu_multi_20151008 was found to contain multiple buffer overflows in the fgets function triggered by the acStack_120 and acStack_220 parameters.
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow via the acStack_50 parameter.
NTSC-CRT version 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c due to the lack of validation of the file's width, height, and BPP. The application was not intended to be a well-tested program.
A vulnerability in the Dispatch tool allows the JWT secret key to be exposed in error messages, potentially leading to account takeover for users relying on the `Dispatch Plugin - Basic Authentication Provider`.
A vulnerability in the AcyMailing Enterprise component for Joomla allows unauthorized actors to obtain the number of subscribers in a specific list.
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
CVE-2023-39971 describes an improper neutralization of input during web page generation vulnerability in the AcyMailing Enterprise component for Joomla, allowing for XSS attacks. This issue affects versions 6.7.0-8.6.3 of the component.
CVE-2023-39970 vulnerability affects the AcyMailing component for Joomla, allowing unrestricted upload of files with dangerous types, leading to remote code execution.
In OpenMNS Horizon version 31.0.8 and earlier than 32.0.2, users with the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. This issue also affects related Meridian versions.
TurboWarp is a desktop application that compiles Scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed malicious projects or custom extensions to read arbitrary files from disk and upload them to a remote server.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated attacker to upload arbitrary files via J-Web. This can lead to a loss of integrity for the file system.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated attacker to upload arbitrary files via J-Web, leading to a loss of file system integrity.
CVE-2023-36845 is a PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS that allows an unauthenticated, network-based attacker to remotely execute code by modifying the PHPRC variable. This enables code injection and execution in the PHP execution environment.
CVE-2023-36844 is a PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS that allows an unauthenticated attacker to modify important environment variables. An attacker can use a crafted request to change certain variables, leading to partial loss of integrity.
CVE-2023-36106 describes an incorrect access control vulnerability in powerjob version 4.3.2 and earlier, allowing remote attackers to obtain sensitive information via the querying interface using the appId parameter to /container/list.
A BeanShell interpreter in remote server mode in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer.
Version 23.01 of lrzip-next was discovered to contain an access violation in the component /bz3_decode_block src/libbz3.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS