CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
IdentityIQ w wersjach 8.3 i wcześniejszych (do 8.3p2), 8.2 i wcześniejszych (do 8.2p5), 8.1 i wcześniejszych (do 8.1p6), oraz 8.0 i wcześniejszych (do 8.0p5) pozwala uwierzytelnionemu użytkownikowi na wywołanie konstruktora Java bez argumentów lub z jednym argumentem typu Map w dowolnej klasie Java dostępnej w ścieżce klas aplikacji IdentityIQ.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.9, allowing for the storage of malicious code.
eMedia Consulting simpleRedak up to version 2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
The Tenda AC8V4.0-V16.03.34.06 device was found to contain a stack overflow vulnerability in the get_parentControl_list_Info function due to the time parameter.
The Tenda AC8V4.0-V16.03.34.06 device was found to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
A stack overflow was discovered in the Tenda AC8V4.0-V16.03.34.06 related to the deviceId parameter in the saveParentControlInfo function.
The Tenda AC8V4.0-V16.03.34.06 device was found to contain a stack overflow vulnerability in the sub_4a79ec function via the time parameter.
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.
An unverified password change exists in the GitHub repository tsolucio/corebos prior to version 8, which may lead to unauthorized access.
A SQL injection vulnerability has been found in the MOVEit Transfer web application before version 2021.0.6, which could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding.
CVE-2023-3000 describes an improper neutralization of special elements used in SQL commands in Erikoglu Technology's ErMon, allowing command line execution through SQL Injection and authentication bypass.
In DataEase, an open source data visualization and analysis tool, prior to version 1.18.7, a deserialization vulnerability exists that can be exploited to execute arbitrary code.
Brook is a cross-platform network tool that includes a vulnerable `tproxy` server susceptible to drive-by command injection. An attacker may trick a victim into visiting a malicious webpage, leading to remote code execution.
Firmware versions of Draytek Vigor routers below 3.9.6/4.2.4, access points below v1.4.0, switches below 2.6.7, and Myvigor below 2.3.2 were found to use hardcoded encryption keys. This allows attackers to bind any affected device to their own account.
An issue was discovered in BMC Patrol through version 23.1.00 that allows remote modification of the agent's configuration without authentication. Some SNMP-related configuration fields can lead to code execution when the agent is restarted.
D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.
The 'GetUserCurrentPwd' function in Microworld Technologies eScan Management Console contains a privilege escalation vulnerability. This allows a remote attacker to retrieve the password of any user (admin or normal) in plain text format.
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
KramerAV VIA GO² versions below 4.0.1.1326 are vulnerable to SQL Injection, which may allow unauthorized access to the database.