CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access, requiring user interaction, to read a subset of service data.
Vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access and unauthorized read access, requiring human interaction and potentially impacting additional products.
Vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access and unauthorized read access, requiring human interaction.
Vulnerability in Oracle REST Data Services (ADP component) affecting versions 24.2.0-26.1.0. A low-privileged authenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access and unauthorized read access to data accessible through the service.
Vulnerability in Oracle REST Data Services (ADP component) affecting versions 24.2.0-26.1.0. A low-privileged authenticated attacker with network access via HTTP can gain unauthorized read access to a subset of data accessible through the service.
A vulnerability in Oracle REST Data Services (Database Actions component) affects versions 24.2.0-26.1.0. A high-privileged attacker with HTTP network access can perform unauthorized update, insert or delete operations, gain unauthorized read access to a subset of data, and cause a partial denial of service.
A vulnerability in Oracle REST Data Services (Database Actions component) affects versions 24.2.0-26.1.0. A low-privileged attacker with HTTP network access, requiring user interaction, can perform unauthorized update, insert or delete operations and gain unauthorized read access to a subset of data, potentially impacting additional products.
A vulnerability in Oracle REST Data Services (Graph QL component) affects versions 24.2.0-26.1.0. An unauthenticated attacker with HTTP network access can gain unauthorized read access to a subset of data accessible through Oracle REST Data Services.
A vulnerability in Oracle REST Data Services (Core component) affects versions 24.2.0-26.1.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with HTTP network access, requiring user interaction, to create, delete or modify critical data and read a subset of data, potentially impacting additional products.
A vulnerability in Oracle REST Data Services (Core component) affects versions 24.2.0-26.1.0. A difficult-to-exploit vulnerability allows a low-privileged attacker with HTTP network access to perform unauthorized update, insert or delete operations and read a subset of data.
A vulnerability in Oracle REST Data Services (Core component) affects versions 24.2.0-26.1.0. A low-privileged attacker with HTTP network access can perform unauthorized update, insert or delete operations and gain unauthorized read access to a subset of data.
A vulnerability in Oracle REST Data Services (Core component) affects versions 24.2.0-26.1.0. An unauthenticated attacker with HTTP network access can perform unauthorized update, insert or delete operations on data accessible through Oracle REST Data Services.
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A stack-based buffer overflow in the boa formTR069Config functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
An arbitrary file write vulnerability in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
A stack-based buffer overflow in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
An OS command injection vulnerability in the boa formWizard newPass functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnPassword parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS