CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Canon printer drivers (Generic Plus PCL6, UFR II, LIPS4, LIPSLX, PS, UFRII LT, CARPS2, Generic FAX, and LIPS4, LIPSLX, UFR II, PS, PCL6 drivers) involves unallocated memory access during print processing. This may lead to driver crashes or unpredictable system behavior.
Out-of-bounds write vulnerabilities have been identified in print processing of Canon printer drivers (Generic Plus PCL6, UFR II, LIPS4, LIPSLX, PS, UFRII LT, CARPS2, Generic FAX, LIPS4, LIPSLX, UFR II, PS, PCL6). These may lead to memory corruption during print data processing.
Out-of-bounds read vulnerabilities exist in print processing of multiple Canon printer drivers, including Generic Plus PCL6, UFR II, LIPS4, LIPSLX, PS, UFRII LT, CARPS2, Generic FAX, and other listed drivers.
A cross-site scripting (XSS) vulnerability was found in the langleyfcu Online Banking System in the /connection_error.php file, in the Error Message Handler component. Manipulation of the Error argument allows remote exploitation. The exploit has been made public.
A vulnerability in Tenda AC18 15.03.05.19 affects an unknown function in /goform/AdvSetLanip. Manipulation of the lanIp argument leads to command injection. The attack can be initiated remotely and the exploit is public.
itsourcecode Hostel Management System 1.0 has an XSS vulnerability in /justines/index.php in the POST Request Handler component. Manipulating the from argument allows remote attacks. The exploit has been publicly released.
A flaw has been found in CodeAstro Online Leave Application 1.0. The vulnerability affects an unknown functionality in the file /leaveAplicationForm.php. Manipulation of the absence[] argument can lead to SQL injection. The attack may be launched remotely. The exploit has been published and may be used.
A vulnerability was detected in CodeAstro Online Leave Application 1.0. It affects an unknown function in the file /signup.php. Manipulation of the city argument results in SQL injection. The attack may be initiated remotely. The exploit is now public and may be used. Other parameters might be affected as well.
PHPGurukul Employee Record Management System 1.3 has an XSS vulnerability in /myprofile.php. Manipulating the First name argument allows remote attacks. The exploit has been publicly disclosed.
A SQL injection vulnerability was detected in CodeAstro Electricity Billing System 1.0 in the /admin/bill.php file. Manipulation of the uid argument allows remote exploitation. The exploit is now public.
A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
A vulnerability was identified in D-Link DIR-823X 250416, involving command injection in function uci_set of /goform/set_wifi_blacklists. Manipulation leads to remote command execution. The exploit is publicly available.
A vulnerability was determined in D-Link DIR-823X 250416, involving command injection in function uci_del of /goform/delete_prohibiting. Manipulation of delvalue allows remote command execution. The exploit is publicly disclosed.
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. Manipulation of the argument macList results in command injection. The attack may be performed from remote, and the exploit has been made public.
A vulnerability was found in D-Link DIR-823X 250416, involving command injection in /goform/set_device_name. Manipulation of mac allows remote command execution. The exploit is publicly disclosed.
A flaw was found in D-Link DIR-823X 250416, involving command injection in /goform/diag_traceroute. Manipulation of target_addr allows remote command execution. The exploit is published.
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Manipulation of the argument delvalue results in command injection. Remote exploitation is possible, and the exploit is now public.
A weakness was identified in D-Link DIR-823X 250416, involving command injection in function sub_412E7C of /goform/set_switch_settings. Manipulation of port allows remote command execution. The exploit is publicly available.
A SQL injection vulnerability was identified in itsourcecode Open Source Job Portal 1.0 in the /admin/employee/index.php?view=edit file. Manipulation of the ID argument allows remote exploitation. The exploit is publicly available.
A SQL injection vulnerability was identified in itsourcecode Open Source Job Portal 1.0 in the /admin/vacancy/index.php?view=edit file. Manipulation of the ID argument allows remote exploitation. The exploit has been made public.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS