CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.
Stored XSS vulnerability in WordPress Sonaar Music Plugin 4.7. Unauthenticated attackers can inject malicious scripts via the comment functionality, which are stored and executed in browsers of users viewing playlist pages.
The WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder component. An unauthenticated attacker can send POST requests to the connector.minimal.php endpoint, creating malicious PHP files in the file_manager directory and executing them on the server.
Kushan2k student-management-system up to commit f16a4ce has an unrestricted file upload vulnerability in service/RegisterService.php via the stimg argument. The attack can be performed remotely, and the exploit is publicly available. The project has not responded.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /index1.php via the Password argument. The attack can be performed remotely and the exploit has been publicly disclosed.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /index2.php via the Password argument. The attack can be performed remotely and the exploit has been publicly disclosed.
A vulnerability in USCiLab Cereal up to 1.3.2 in the Shared Pointer Handler component can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed.
BeikeShop up to version 1.6.0.22 has an improper authorization vulnerability in the Stripe Plugin component in StripeController.php via the Request argument. The attack can be performed remotely, and the exploit is publicly available. A patch is available at commit 6719e0fc.
A flaw in Boost Serialization up to version 1.91 in an unknown function causes improper validation of specified input types. The attack can be initiated remotely, and an exploit has been published. The maintainer was notified but no patch is available yet.
Xcitium Client Security before 13.8.2.10019 and Comodo Internet Security through 12.3.4.8162 have an integer underflow in the firewall driver Inspect.sys. Sending a crafted IPv6 packet with payload length smaller than extension-header lengths causes an out-of-bounds read and system crash (BSOD).
Injection vulnerability in JeeWMS (up to 141740afb2ba14d441c82a833d0a418d07ca2d69) in /base-boot/jmreport/testConnection via dbType/dbDriver/dbUrl/dbUsername/dbPassword arguments. Remote attack, exploit public.
A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.
A command injection vulnerability was found in GL.iNet GL-MT3000 up to version 4.4.5 in the function FUN_0042e200 of /cgi-bin/glc. The vendor claims it is fixed in version 4.8.1, but details are disputed.
In the GL.iNet GL-MT3000 device with firmware version 4.4.5, a command injection vulnerability was found in the snprintf function of the file /cgi-bin/glc in the FTP Protocol Handler component. Manipulating the media_dir argument can lead to command injection. The attack can be launched remotely. The vendor states that in version 4.8.1, single quotes are escaped, preventing the reported attack vectors.
A command injection vulnerability exists in the dlopen function of the /usr/lib/oui-httpd/rpc/ library in GL.iNet GL-MT3000 version 4.4.5 via the dev_name argument. The attack is remotely exploitable. The vendor confirms that version 4.7 introduces HTTP method-level validation, mitigating the issue.
clash-verge-service-ipc before version 2.3.0 exposes a world-reachable IPC endpoint, allowing local privilege escalation.
Server-side request forgery (SSRF) vulnerability in perfree go-fastdfs-web up to version 1.3.7. The checkServer function in /install/checkServer allows remote manipulation leading to SSRF. Exploit has been published and may be used. Vendor did not respond.
A SQL injection vulnerability was found in Jinher OA 1.0 in the file nextselectplan.aspx via the httpOID argument. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor did not respond.
Vulnerability in JingDong JD Cloud Box AX6600 (version 4.5.3.r4546) in the set_macfilter function. Manipulation leads to stack-based buffer overflow, enabling remote attack.
A vulnerability in the Protocol::HTTP2 library for Perl before version 1.13 allows an HTTP/2 Bomb attack. The HPACK decode path lacks a header-list size limit, so a small HTTP/2 request can expand into large server memory. The headers_decode method performs no running size check, and stream_header_block_add appends CONTINUATION frames unbounded.