CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W podatności CVE-2026-3120 występuje niewłaściwa kontrola generowania kodu, co prowadzi do możliwości wstrzyknięcia poleceń systemowych w aplikacji SambaBox. Problem dotyczy wersji od 5.1 do przed 5.3.
A vulnerability was detected in Totolink N300RH version 3.2.4-B20220812, affecting the function setMacFilterRules in the file /cgi-bin/cstecgi.cgi. Manipulation of the argument mac_address results in buffer overflow.
A vulnerability has been detected in Totolink N300RH 3.2.4-B20220812 affecting the setWanConfig function in the /cgi-bin/cstecgi.cgi file. Manipulation of the priDns argument leads to buffer overflow.
A weakness has been identified in Totolink N300RH version 3.2.4-B20220812, concerning the setUpgradeFW function in the /cgi-bin/cstecgi.cgi file. Manipulating the FileName argument can lead to buffer overflow, allowing for remote attacks.
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing an out-of-bounds write on the heap.
A vulnerability was identified in osrg GoBGP up to version 4.3.0, concerning the parseRibEntry function in the pkg/packet/mrt/mrt.go file. Manipulating this function can lead to integer underflow, allowing for remote attacks.
phpBB w wersjach przed 3.3.16 jest podatny na atak typu Host Header Injection, co może prowadzić do zafałszowania linków do resetowania haseł. Gdy opcja force_server_vars jest wyłączona, nazwa hosta serwera może być pobrana z nagłówka HTTP Host, co jest używane do generowania URL do resetowania hasła.
A vulnerability was found in osrg GoBGP up to version 4.3.0, affecting the function PathAttributeAigp.DecodeFromBytes in the file pkg/packet/bgp/bgp.go. Manipulating this function can lead to buffer overflow, allowing for remote attacks.
A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.
A vulnerability was identified in Shandong Hoteam Software PDM Product Data Management System up to version 8.3.9, allowing SQL injection via manipulation of the SortOrder argument in the GetQueryMachineGridOnePageData function.
A flaw has been found in PrefectHQ prefect up to version 3.6.13, which can lead to missing authentication in an unknown function of the file /api/events/in of the WebSocket Endpoint component. The attack may be performed remotely.
A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227 affecting the UploadCustomModule function in the /cgi-bin/cstecgi.cgi file. Manipulating the File argument can lead to buffer overflow, which can be exploited remotely.
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. A specially crafted malicious URL can lead to arbitrary JavaScript code execution.
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. A specially crafted malicious URL can lead to arbitrary JavaScript code execution.
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypass.
A weakness has been identified in MindsDB up to version 26.01, impacting the exec function in the mindsdb/integrations/handlers/byom_handler/proc_wrapper.py file of the Engine Handler component. Executing a manipulation can lead to unrestricted file uploads.
A security flaw has been discovered in YunaiV yudao-cloud up to version 3.8.0 in the doFilterInternal function of the JwtAuthenticationTokenFilter.java file of the Ruoyi-Vue-Pro component. Manipulating the mock-token argument results in improper authentication.
A flaw has been found in AV Stumpfl Pixera Two Media Server up to version 25.2 R2 in an unknown function of the Websocket API component, allowing for code injection. The attack can be initiated remotely.
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform version 7.17.0, affecting an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Manipulation of the argument week leads to OS command injection.
A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0, affecting an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Manipulation of the argument fCircuitids leads to SQL injection.