CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w zapytaniach SQL w pliku rsvpmaker-util.php. Atakujący mogą uzyskać dostęp do wrażliwych informacji z bazy danych w wersjach do 9.2.5 włącznie.
Wtyczka Metform dla WordPressa jest podatna na ujawnienie wrażliwych informacji z powodu niewłaściwej kontroli dostępu w pliku ~/core/forms/action.php. Atakujący bez uwierzytelnienia może wykorzystać tę lukę, aby uzyskać dostęp do wszystkich kluczy API i sekretów zintegrowanych zewnętrznych API, takich jak PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA i inne, w wersjach do 2.1.3 włącznie.
The LMS Doctor Simple 2 Factor Authentication Plugin for Moodle version 2021072900 has an Insecure Direct Object References (IDOR) vulnerability. This allows remote attackers to update sensitive records such as email, password, and phone number of other user accounts.
Brak walidacji danych wejściowych w SMM może umożliwić atakującemu stworzenie błędu, który pozostawia aplikację DRTM UApp w częściowo zainicjowanym stanie, co może prowadzić do utraty integralności pamięci.
TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow vulnerability in the `MntAte` function. Local users can achieve remote code execution.
A stack overflow vulnerability exists in the `MmtAtePrase` function of TP-Link TL-WDR7660, Mercury D196G, and Fast FAC1900R routers. Local users can achieve remote code execution.
A stored XSS vulnerability was found in the Add New Employee form of Sourcecodester Employee Daily Task Management System 1.0. A remote attacker can inject and store arbitrary JavaScript code via the Name field, which executes when the data is viewed.
An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4 related to command injection by an authenticated attacker. The attacker can exploit shell metacharacters within the Network Tools section of the web-management interface, affecting all three networking tools: Ping, Traceroute, and DNS Lookup.
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Argo Workflows to otwartoźródłowy silnik do orkiestracji równoległych zadań w Kubernetes. W podatnych wersjach atakujący może stworzyć workflow, który generuje artefakt HTML zawierający skrypt wykorzystujący wywołania XHR do interakcji z API Argo Server, co może prowadzić do nieautoryzowanego dostępu do informacji o workflow ofiary.
In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.
A directory traversal vulnerability in Bookeen Notea Firmware BK_R_1.0.5_20210608 allows an attacker to obtain sensitive information by manipulating file paths.
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
In Sourcecodester Doctor's Appointment System 1.0, a vulnerability allows remote code execution (RCE) via malicious file upload as an image from the admin panel. An attacker can gain full server control just by knowing the path where images are stored.
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. An attacker can exploit this flaw to gain unauthorized control over the device.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. The flaw is located in the checkNet function within /cgi-bin/luci/api/auth.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose. An attacker can send a crafted request to execute arbitrary code on the device.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch. An attacker can send a crafted request to execute arbitrary code on the device.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW series routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose. An attacker can send a crafted request to execute arbitrary code on the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS