CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers.
Tenda W308R v2 version V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.
W Wazuh, od wersji 4.4.0 do przed wersją 4.14.4, występuje podatność typu path traversal w procedurze synchronizacji klastra, która pozwala uwierzytelnionemu uczestnikowi klastra na zapisanie dowolnych plików poza zamierzonym katalogiem na innych węzłach klastra. Może to prowadzić do wykonania kodu w kontekście usługi Wazuh poprzez nadpisanie modułów Pythona używanych przez komponenty Wazuh.
DocsGPT, a GPT-powered chat for documentation, has a vulnerability in versions from 0.15.0 to before 0.16.0 that allows an attacker to achieve remote code execution (RCE) via a malicious payload bypassing the 'MCP test'. This issue has been patched in version 0.16.0.
Podatność typu 'Path Traversal' w TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center umożliwia nieprawidłowe ograniczenie ścieżki do zastrzeżonego katalogu. Problem dotyczy wersji Pardus Software Center przed 0.6.4.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Cockpit w wersji 2.13.5 i wcześniejszych jest podatny na wykonanie dowolnego kodu poprzez parametr filter w wielu punktach końcowych. Ta podatność umożliwia atakującemu uruchamianie poleceń systemowych na infrastrukturze bazowej za pomocą operatora $func MongoLite.
W urządzeniu TOTOLINK N200RE V5 odkryto podatność na wstrzykiwanie poleceń poprzez parametry macstr i bandstr w funkcji formMapDelDevice.
Jenkins GitHub Plugin version 1.46.0 and earlier improperly processes the current job URL in JavaScript, leading to a stored XSS vulnerability. Attackers with Overall/Read permissions can exploit this flaw.
Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker-controlled HTTP response headers. The application constructs local file paths using values derived from HTTP headers without validation, allowing attackers to write files outside the intended update staging directory.
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success, allowing attacker-supplied executables to be accepted and later executed by the application.
MegaCMS version 12.0.0 has an SQL injection (SQLi) vulnerability in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The issue arises from inadequate validation and sanitization of user input.
Google Chrome prior to version 147.0.7727.138 has a use-after-free vulnerability in the GPU component. A remote attacker can potentially escape the browser sandbox via a crafted HTML page.
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.
OpenClaw before version 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.
The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.
The NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system that allows an unauthenticated attacker to bypass authorization through a user-controlled key. Successful exploitation of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
Podatność CVE-2026-41873 dotyczy niekonsekwentnej interpretacji żądań HTTP w Pony Mail, co może prowadzić do przejęcia konta administratora. Problem ten występuje we wszystkich wersjach implementacji Lua Pony Mail, która została wycofana.
Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.
CVE-2026-7321 is a vulnerability related to incorrect boundary conditions in the WebRTC networking component, leading to a sandbox escape.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS