CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered on the D-Link DWR-932B router, allowing file reading via ..%2f traversal in qmiweb.
An issue was discovered on the D-Link DWR-932B router, allowing directory listing via ../ traversal in the qmiweb interface.
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
An issue was discovered on the D-Link DWR-932B router, where qmiweb provides sensitive information in response to CfgType=get_homeCfg requests.
An issue was discovered on the D-Link DWR-932B router related to WPS PIN generation based on srand(time(0)) seeding.
An issue was discovered on the D-Link DWR-932B router related to a hardcoded WPS PIN of 28296607.
An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).
An issue was discovered on the D-Link DWR-932B router related to undocumented TELNET and SSH services that allow logins as admin with the password 'admin' and as root with the password '1234'.
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL. There is also an apply_noauth.cgi URL that enables unauthenticated users to perform sensitive actions on the device.
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number can be used to obtain the administrator username and password in conjunction with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
Router NETGEAR WNR2000v5 zawiera przepełnienie bufora w parametrze hidden_lang_avi podczas wywoływania adresu URL /apply.cgi?/lang_check.html. To przepełnienie bufora może być wykorzystane przez nieautoryzowanego atakującego do zdalnego wykonania kodu.
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
The Sophos Web Appliance Remote / Secure Web Gateway server version 4.2.1.3 is vulnerable to remote command injection in its administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php, where user input is improperly processed, allowing malicious commands to be executed.
The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php component responsible for blocking and unblocking IP addresses.
The ISO CLNS parser in tcpdump before version 4.9.0 has a buffer overflow in the clnp_print() function in print-isoclns.c.
The ISO CLNS parser in tcpdump before version 4.9.0 has a buffer overflow in the lookup_nsap() function in addrtoname.c.
The ATM parser in tcpdump before version 4.9.0 has a buffer overflow in function print-atm.c:sig_print().
The SNMP parser in tcpdump before version 4.9.0 has a buffer overflow in the asn1_parse() function in print-snmp.c.
The Q.933 parser in tcpdump before version 4.9.0 has a buffer overflow in print-fr.c:q933_print(). This is a different vulnerability than CVE-2016-8575.
In tcpdump before version 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN, and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().