CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce Analytify Simple Social Media Share Buttons umożliwia przeprowadzenie ataku CSRF. Problem ten dotyczy wersji wtyczki od n/a do 6.2.0.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce Analytify Under Construction, Coming Soon & Maintenance Mode umożliwia przeprowadzenie ataku CSRF. Problem ten dotyczy wersji od n/a do 2.1.1.
A vulnerability in Apache ActiveMQ allows an authenticated attacker to achieve remote code execution on the broker via the Jolokia JMX-HTTP endpoint. The attack invokes network connector operations with a crafted URI that loads a remote Spring XML context, leading to arbitrary code execution in the broker's JVM.
Wtyczka Booking for Appointments and Events Calendar – Amelia dla WordPressa jest podatna na nieautoryzowany dostęp do obiektów w wersjach do 2.1.3 włącznie. Problem wynika z braku walidacji zmian w polu `externalId` podczas aktualizacji profilu użytkownika typu Provider (Pracownik).
Podatność w bibliotece HuggingFace Transformers, szczególnie w klasie `Trainer`, umożliwia wykonanie dowolnego kodu. Metoda `_load_rng_state()` w pliku `src/transformers/trainer.py` wywołuje `torch.load()` bez parametru `weights_only=True`, co stwarza ryzyko w wersjach biblioteki wspierających `torch>=2.2` przy użyciu PyTorch poniżej 2.6.
Podatność CVE-2025-65115 dotyczy zdalnego wykonania kodu w różnych wersjach oprogramowania JP1/IT Desktop Management 2 oraz Job Management Partner 1 na systemie Windows. Problem ten występuje w wielu wersjach menedżerów i klientów związanych z zarządzaniem desktopami oraz dystrybucją oprogramowania.
W Modemie występuje możliwe zapisanie danych poza przydzielonym obszarem z powodu braku sprawdzenia granic. Może to prowadzić do zdalnego eskalowania uprawnień, jeśli urządzenie końcowe połączy się z fałszywą stacją bazową kontrolowaną przez atakującego, bez potrzeby dodatkowych uprawnień do wykonania.
In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege if a UE connects to a rogue base station controlled by the attacker. User interaction is required for exploitation.
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
Vulnerability in Totolink A7100RU router in the setFirewallType function in /cgi-bin/cstecgi.cgi. Manipulation of the firewallType argument leads to OS command injection. The attack can be carried out remotely.
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setRemoteCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setNtpCfg function of /cgi-bin/cstecgi.cgi. Manipulating the tz argument allows remote command execution. A public exploit is available.
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Manipulating the provider argument allows remote command execution. A public exploit is available.
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.
A stack-based buffer overflow vulnerability was identified in the Tenda CX12L device version 16.03.53.12 in the fromNatStaticSetting function of the /goform/NatStaticSetting file. The attack can be performed remotely by manipulating the page argument. The exploit has been made public.
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic in the file /goform/RouteStatic, where manipulation of the page argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
The Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromAddressNat function of /goform/addressNat. Manipulation of the page argument allows remote exploitation.
In Tenda CX12L version 16.03.53.12, the function fromwebExcptypemanFilter in /goform/webExcptypemanFilter is vulnerable to stack-based buffer overflow via manipulation of the argument page. The attack requires local network access, and the exploit is publicly disclosed.