CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
TOTOLINK A3300R router firmware v17.0.0cu.557 is vulnerable to Command Injection via the /cgi-bin/cstecgi.cgi CGI script. An attacker can remotely execute arbitrary system commands without authentication.
Wtyczka RegistrationMagic dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 5.2.1.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Google, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
Wtyczka WP Visitor Statistics (Real Time Traffic) dla WordPressa w wersjach przed 6.9 nie zabezpiecza danych wejściowych użytkowników, które są łączone z zapytaniem SQL. To umożliwia nieautoryzowanym odwiedzającym przeprowadzanie ataków typu SQL Injection.
An authentication bypass vulnerability in the Optoma 1080PSTX C02 projector allows an attacker to access the administration console without valid credentials.
Medical Systems Co. Medisys Weblab Products v19.4.03 contains a SQL injection vulnerability. The flaw exists in the WSDL files via the tem:statement parameter.
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
NS-ASG v6.3 was found to have a SQL injection vulnerability in the /admin/add_ikev2.php script. An attacker can exploit this flaw to manipulate database queries.
W systemie Online Food Ordering System v2.0 występuje podatność na przesyłanie dowolnych plików w komponencie /admin/ajax.php?action=save_menu, co pozwala atakującym na wykonanie dowolnego kodu poprzez przesłanie spreparowanego pliku PHP.
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for Windows, which contains improper permissions within the default installation. This vulnerability allows attackers to execute arbitrary code and gain escalated privileges.
GL.iNET MT3000 version 4.1.0 Release 2 is vulnerable to OS command injection via the /usr/lib/oui-httpd/rpc/logread endpoint. An attacker can remotely execute arbitrary commands on the system.
Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.
Nanoleaf firmware version 7.1.1 and below lacks TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
Wtyczka Profile Builder – User Profile & User Registration Forms dla WordPress jest podatna na nieautoryzowane resetowanie haseł w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej walidacji funkcji resetowania hasła, która używa wartości w postaci czystego tekstu zamiast wartości haszowanej.
A remote code execution (RCE) vulnerability was discovered in the Aigital Wireless-N Repeater Mini_Router firmware version v0.131229 via the sysCmd parameter in the formSysCmd function. This flaw can be exploited by sending a crafted HTTP request.
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series 4.60 through 5.35, USG FLEX series 4.60 through 5.35, and ATP series 4.60 through 5.35. An unauthenticated attacker could execute OS commands remotely by sending crafted packets to an affected device.
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required. The flaw exists within the SetupCompleted class due to improper access control. An attacker can bypass authentication and execute arbitrary code in the context of SYSTEM.
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
A command injection vulnerability was discovered in the Nanoleaf Desktop App before version 1.3.1, which is exploited via a crafted HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS