CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.
A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).
In jupyter-server versions 1.12.0 through 2.17.0, a vulnerability allows bypassing CORS origin validation when using `allow_origin_pat`. The issue is due to `re.match()` only anchoring at the start, allowing attacker-controlled domains like `trusted.example.com.evil.com` to pass validation for patterns intended for `trusted.example.com`. This affects CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing, arbitrary code execution, and unauthorized access to sensitive API responses.
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object.
GLPI from version 10.0.4 to 10.0.24 allows a technician to store an XSS payload in the asset locked tab. The payload executes when an administrator views the tab.
Vulnerability in GLPI (versions 9.5.0 through 10.0.24 and 11.0.6) allows low-privilege users with planning access to delete any object in the system.
In GLPI (IT management software) from version 0.78 to 10.0.24 and 11.0.6, a technician can delete arbitrary files from the filesystem if the webserver has write permissions on them.
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.
A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) in FRRouting (FRR) from stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
An inclusion of functionality from untrusted control sphere vulnerability in the MinGW DLL component in Synology Hyper Backup Explorer before version 3.0.1-0156 allows local users to execute arbitrary code.
An inclusion of functionality from untrusted control sphere vulnerability in the OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before version 2.5.0-2081 allows local users to execute arbitrary code.
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
Vulnerability in the ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient input validation.
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.