CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
InfluxDB before version 1.8.10 does not enforce authentication, allowing unauthenticated attackers to execute arbitrary commands. The vendor notes that authentication is disabled by default and should be enabled for public endpoints.
W systemie zamawiania jedzenia online w wersji 1.0 odkryto podatność na atak typu SQL injection, która występuje w komponencie /dishes.php?res_id=.
In SQLite 3.31.1, there is an out-of-bounds access problem through ALTER TABLE for views that have a nested FROM clause.
Doctor's Appointment System 1.0 is vulnerable to incorrect access control in the file edoc/patient/settings.php. The lack of authorization allows an attacker to manipulate the id parameter, leading to unauthorized access to other patients' data.
A vulnerability in the firmware of Tenda AC6 (AC1200) v5.0 and below allows attackers to remove the Wi-Fi password and force the device into open security mode by sending a crafted packet to the goform/setWizard form.
An access control issue was discovered in the TOTOLINK A7000R router running firmware version V4.1cu.4134, specifically in the /cgi-bin/ExportSettings.sh script. Lack of proper authentication allows unauthorized access to export device settings.
A buffer overflow vulnerability exists in the Linksys E1200 router firmware version 1.0.04 in the ej_get_web_page_name function. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main.
TRENDnet TEW733GR router version 1.03B01 is vulnerable to command injection in the /htdocs/upnpinc/gena.php script. An attacker can remotely execute arbitrary system commands without authentication.
A vulnerability in the firmware of D-Link DIR-615 router version 20.06 allows unauthenticated access to the WAN configuration page (wan.htm). This enables reading WAN settings and modifying data fields on the page.
TP-Link Archer A7 router with firmware Archer A7(US)_V5_210519 is vulnerable to command injection in /usr/bin/tddp. The program incorrectly uses part of the received data packet as part of a command, allowing an attacker to execute arbitrary commands on the device.
A remote command execution (RCE) vulnerability was discovered in Tenda AC18 with firmware version V15.03.05.05. An attacker can exploit this flaw to take control of the device without authorization.
An issue was discovered in taocms 3.0.2 in the website settings that allows arbitrary PHP code to be injected by modifying config.php.
W repozytorium GitHub cockpit-hq/cockpit przed wersją 2.2.2 występuje niewłaściwe usuwanie wrażliwych informacji przed ich przechowaniem lub transferem. Może to prowadzić do nieautoryzowanego dostępu do danych.
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.
An attacker who submits a crafted tar file with size in header struct being 0 may trigger a call to malloc(0) for the variable gnu_longlink, leading to an out-of-bounds read.
Zagrożone urządzenia nieprawidłowo sanitizują pole wejściowe. Może to pozwolić uwierzytelnionemu zdalnemu atakującemu z uprawnieniami administratora na wstrzyknięcie kodu lub uruchomienie powłoki systemowej z uprawnieniami roota.
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
In Bolt 5.1.7, the foldername parameter has incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via crafted input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS