CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
The TOTOLINK EX1200T device with firmware version V4.1.2cu.5215 is affected by a command injection vulnerability that allows remote arbitrary code execution.
W systemie zamawiania jedzenia online w wersji 1.0 odkryto podatność na wstrzykiwanie SQL poprzez parametr Search w pliku food-search.php.
The D-Link DSL-G2452DG (hardware version T1, firmware ME_2.00) was found to have insecure permission settings. This vulnerability could allow unauthorized users to access sensitive functions or data.
An arbitrary file upload vulnerability in Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.
SolarView Compact version 6.00 was found to contain a command injection vulnerability via conf_mail.php. An attacker can exploit this to execute arbitrary system commands on the device.
A OS command injection vulnerability exists in the CGI program of Zyxel USG FLEX, ATP, and VPN series firmware. It allows an attacker to modify specific files and execute OS commands on the vulnerable device. Affected versions include USG FLEX 100(W) 5.00-5.21 Patch 1, USG FLEX 200, 500, 700, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN series.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w pliku rsvpmaker-api-endpoints.php. Umożliwia to nieautoryzowanym atakującym kradzież wrażliwych informacji z bazy danych w wersjach do 9.2.6 włącznie.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w zapytaniach SQL w pliku rsvpmaker-util.php. Atakujący mogą uzyskać dostęp do wrażliwych informacji z bazy danych w wersjach do 9.2.5 włącznie.
In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, there is a SQL injection vulnerability in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
In Sourcecodester Doctor's Appointment System 1.0, a vulnerability allows remote code execution (RCE) via malicious file upload as an image from the admin panel. An attacker can gain full server control just by knowing the path where images are stored.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. The flaw is located in the checkNet function within /cgi-bin/luci/api/auth.
A vulnerability in SiteServer CMS version 7.x allows attackers to execute arbitrary code via a crafted plug-in. The flaw stems from insufficient security checks on plug-ins loaded into the system.
A vulnerability in Wondershare Dr. Fone (version as of 2021-12-06) allows remote code execution. An unauthenticated user can communicate over UDP with the InstallAssistService.exe service (running with SYSTEM privileges) and manipulate it to execute a malicious executable without any validation, gaining SYSTEM privileges.
The vulnerability in the httpx library before version 0.23.0 is caused by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. This can lead to unexpected behavior or potential attacks.
CuppaCMS v1.0 contains a SQL injection vulnerability in the file /administrator/alerts/alertLightbox.php. An attacker can exploit this flaw to execute unauthorized database queries.
CuppaCMS v1.0 contains a SQL injection vulnerability in the menu_filter parameter at /administrator/templates/default/html/windows/right.php. An attacker can exploit this flaw to manipulate database queries.
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS