CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
A vulnerability was detected in Totolink NR1800X version 9.1.0u.6279_B20210910, affecting the function sub_41A68C in the file /cgi-bin/cstecgi.cgi. Manipulating the argument setUssd results in command injection.
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint, leading to SQL injection vulnerability.
A vulnerability has been found in Fujian Apex LiveBOS up to version 2.0, affecting an unknown function of the file /feed/UploadImage.do of the Endpoint component. Manipulation of the argument filename leads to path traversal.
A vulnerability has been found in UTT HiPER 1200GW up to version 2.5.3-170306, affecting the strcpy function in the /goform/formRemoteControl file. Manipulation of this function leads to buffer overflow.
A flaw has been found in UTT HiPER 1200GW up to version 2.5.3-1703 in the strcpy function of the /goform/formUser file. Executing a manipulation can lead to buffer overflow, which can be exploited remotely.
A path traversal vulnerability in the profile import feature of Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14 allows an attacker to cause denial of service or possibly execute arbitrary code.
A vulnerability in the RDP protocol dissector in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 causes a crash, potentially leading to denial of service and possible code execution.
A vulnerability in the SBC codec decompression in Wireshark can cause a crash, denial of service, and potentially code execution. Affects versions 4.6.0-4.6.4 and 4.4.0-4.4.14.
A vulnerability has been found in SourceCodester Hotel Management System 1.0, affecting an unknown function of the file /index.php/reservation/check. Manipulation of the argument room_type leads to SQL injection.
A flaw has been found in GoClaw and GoClaw Lite up to version 3.8.5, affecting an unknown function of the RPC Handler component. This manipulation causes improper authorization, potentially allowing remote attacks.
HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text, leading to execution through the bridge session manager.
A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137, concerning the function setWiFiMultipleConfig in the library /lib/cste_modules/wireless.so. Manipulation of the argument wepkey2 results in buffer overflow, which can be exploited remotely.
IBM Langflow Desktop versions 1.0.0 through 1.8.4 allow an attacker to execute arbitrary commands with the privileges of the process running Langflow. This enables reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.
IBM Turbonomic prometurbo agent versions 8.16.0 through 8.17.6 grant excessive cluster-wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements.
IBM Langflow Desktop versions 1.0.0 through 1.8.4 could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.
In Traefik versions prior to 2.11.43, 3.6.14, and 3.7.0-rc.2, a high severity authentication bypass vulnerability exists in the StripPrefixRegex middleware when used with ForwardAuth, BasicAuth, or DigestAuth. The issue arises from a mismatch between the decoded URL path and the raw path after stripping, allowing a request with a dot-segment (e.g., /./admin/secret) to reach the backend, which normalizes it to the protected path.
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to version 14.50. Attackers with local control of the Windows client can send malformed data to an API and elevate their level of privilege to system.
CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to version 14.50. Attackers can send a modified message to the client, potentially leading to memory overwrite and denial of service.