CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can send overly long strings to the test4, ssid2, and username fields to execute arbitrary commands or cause a device crash.
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the app.cgi interface. A remote attacker can send an overly long string to the netAcc.addlist[].name field to execute arbitrary commands or cause a device crash.
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
In the Linux kernel, the decode_lockers() function in libceph contains two unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before reading the locker count and lock type can lead to unauthorized memory reads. The vulnerability is fixed by replacing the unsafe operations with safe variants that include bounds checking.
The AI Copilot – Content Generator plugin for WordPress up to version 1.5.6 has an authorization bypass vulnerability. Unauthenticated attackers can create an administrator account and take over the site by saving and executing a malicious workflow with wp_create_user. This is possible because the nonce is exposed in public JavaScript.
OpenYak is a local-first agent runtime, and prior to version 1.1.3 the desktop backend binds an HTTP API to 127.0.0.1:random port without Origin validation, loopback authentication, or Content-Type enforcement, with a wildcard CORS policy. Any webpage visited while OpenYak is running can issue cross-origin requests to this local server, allowing arbitrary shell command execution on the host (RCE), service shutdown, and exfiltration of chat history and PII.
scim-patch, a library for SCIM patch operations, prior to version 0.9.1 is vulnerable to prototype pollution when applying a SCIM PATCH operation whose 'value' object contains a key like '__proto__.someProp'. After such a patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process.
Kata Containers prior to version 3.31.0 is vulnerable to a guest-root to host-root escape in the standalone virtio-fs path. In this configuration, the host virtiofsd runs as root with --sandbox none --seccomp none, allowing an attacker with root access in the guest to bypass the guest virtio-fs client and submit raw FUSE requests to the host virtiofsd, creating symlinks in sensitive host locations such as /etc/cron.d, leading to host code execution as root.