CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
The groups page in Moodle has a vulnerability that requires additional content sanitization to prevent XSS risk. This issue affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, and 3.11 to 3.11.14.
An issue was discovered in WAFU Keyless Smart Lock v1.0 that allows attackers to unlock a device via code replay attack.
Buffer overflow was discovered in TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3, and TL-WR941ND V5/V6 in the component /userRpm/QoSRuleListRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlAccessTargetsRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Devices TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were found to have a buffer read out-of-bounds vulnerability in the /userRpm/VirtualServerRpm component. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
A buffer overflow vulnerability was discovered in TP-Link TL-WR940N V4 via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Devices TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 have a buffer overflow vulnerability in the component /userRpm/AccessCtrlTimeSchedRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
FLVMeta v1.2.1 was found to contain a buffer overflow in the xml_on_metadata_tag_only function at dump_xml.c.
Version 0.4.7 of the libming library was found to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function in parser.c.
TOPdesk version 12.10.12 has an XML Signature Wrapping (XSW) vulnerability in the SAML-based Single Sign-on feature. This allows bad actors with credentials to authenticate with the Identity Provider and impersonate any TOPdesk user via SAML Response manipulation.
In versions 1.1 and through commit 8a1d882b4c481a05e296e9b38a7961e912146a0f of the dmarcts-report-viewer dashboard, there is a cross site scripting (XSS) vulnerability. It allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.
CVE-2023-3326 affects the pam_krb5 module, which authenticates users by running kinit with the password. If a keytab is not provisioned on the system, the module trusts responses from the KDC, potentially allowing unauthorized access.
Advantech R-SeeNet version 2.4.22 allows low-level users to access and load the content of local files.
Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.
EyouCMS version 1.6.3 has a cross site scripting (XSS) vulnerability in the filing number on the backend management page under the Basic Information tab.
The WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions <= 3.5.7 has a stored Cross-Site Scripting (XSS) vulnerability with admin+ privileges.
The realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions up to 1.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS