CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
The Totolink A3100R router with firmware version V5.9c.4577 suffers from a vulnerability due to the use of insufficiently random values in the web configuration. The SESSION_ID is predictable, allowing an attacker to hijack a valid session and conduct further malicious operations.
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.
In the Totolink A3100R router with firmware version V5.9c.4577, a hard-coded Telnet password was discovered that can be extracted from the official firmware release. An attacker connected to the Wi-Fi can easily gain root shell access via Telnet if the service is enabled.
The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.
In Totolink A3100R firmware version V5.9c.4577, the test.asp file exposes an unauthenticated API-like function. This allows an attacker to modify multiple device settings without any authentication.
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in the login function which lets attackers generate high privileged accounts passwords.
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to inject malicious scripts or HTML via the 'special' field.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
A use-after-free in the Linux kernel's tc_new_tfilter can allow a local attacker to escalate privileges. It requires unprivileged user namespaces.
An access control issue was discovered in NUUO software version v03.11.00. This vulnerability may allow an unauthorized user to bypass security mechanisms.
A remote command execution (RCE) vulnerability was discovered in D-Link DIR-820L version 1.05B03 via an HTTP POST request to the get set ccp function.
CheckMK Raw Edition versions 1.5.0 to 1.6.0 do not sanitize input of a web service parameter in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor with HTML content interpreted by the browser (e.g., JavaScript) or steal session cookies of an authenticated user via man-in-the-middle.
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitize uploaded .mkp files (Extension Packages), allowing remote code execution. Exploitation requires access to the management interface with valid credentials or a hijacked admin session.
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) has a misconfiguration of the default Dokuwiki web app, allowing embedded PHP code. This leads to remote code execution. Exploitation requires access to the management interface with valid credentials or a hijacked admin session.
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table. An attacker can inject a malicious script that will be executed in the victim's browser.
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit a crafted POST request to perform unauthorized actions on behalf of an authenticated user.
The vulnerability in SurveyKing v0.2.0 retains users' session cookies after logout. An attacker can use the browser cache to log in to the system and access data when the user exits the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS