CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow vulnerability was found in the cgiSysTimeInfoSet function in /bin/httpd of Tenda W12 router version 3.0.0.7(4763). Remote attack is possible by manipulating the sec argument. The exploit has been publicly disclosed.
In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgistaKickOff function of the /bin/httpd file. Manipulation of the staMac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
An SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file /patient.php via the editid argument. The attack can be executed remotely and the exploit is publicly available.
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=delete via the ID argument. The attack can be executed remotely and the exploit is publicly available.
A stack-based buffer overflow was identified in TRENDnet TEW-432BRP version 3.10B20 in the formWlanSetup function of the /goform/formWlanSetup file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.
OpenCATS up to version 0.9.7.4 contains an SQL injection vulnerability in the sortDirection parameter of the DataGrid component. Authenticated users can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php to perform time-based blind injection attacks and extract sensitive database contents.
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSysCmd function of the /goform/formSysCmd file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
In the TRENDnet TEW-432BRP router version 3.10B20, the function formSetWlanEncrypt in /goform/formSetWlanEncrypt is vulnerable to stack-based buffer overflow via the webpage argument. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product is EOL since 2009 and will not be fixed.
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 has a weakness in the sign_auth_cookie function of the file application/controllers/Login.php in the MY_Controller component. Manipulation of the role argument can lead to improper authentication, allowing remote attack. Exploit is publicly available.
A stack-based buffer overflow was identified in Edimax BR-6478AC version 1.23 in the formWanTcpipSetup function of the /goform/formWanTcpipSetup file. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability was found in Edimax BR-6478AC 1.23. The function formUSBFolder of the file /goform/formUSBFolder is affected by buffer overflow via manipulation of the ShareName/SelectName arguments, allowing remote exploitation.
A vulnerability has been found in Edimax BR-6478AC 1.23. The function formUSBAccount of the file /goform/formUSBAccount is affected by buffer overflow via manipulation of the UserName/Password arguments, allowing remote exploitation.
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSetPassword function of the /goform/formSetPassword file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
A stack-based buffer overflow was detected in TRENDnet TEW-432BRP version 3.10B20 in the formResetStatistic function of the /goform/formResetStatistic file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSetEnableWizard function of the /goform/formSetEnableWizard file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. The function formSysLog of the file /goform/formSysLog is affected by stack-based buffer overflow via manipulation of the current_page argument, allowing remote exploitation. The vendor states the product has been EOL for 15 years and will not be fixed.
A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. The function formPortFw of the file /goform/formPortFw is affected by stack-based buffer overflow via manipulation of the server_name argument, allowing remote exploitation. The vendor states the product has been EOL for 15 years and will not be fixed.