CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
givanz VvvebJs 1.7.2 is vulnerable to insecure file upload, which may allow an attacker to upload malicious files to the server.
givanz VvvebJs 1.7.2 suffers from a file upload vulnerability via save.php, which may allow an attacker to upload dangerous files.
A critical vulnerability in givanz VvvebJs 1.7.2 allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. It stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks.
Tugtainer to aplikacja do automatyzacji aktualizacji kontenerów Docker. W wersjach przed 1.15.1 istnieje możliwość wstrzykiwania dowolnych argumentów w `POST api/command/run` w tugtainer-agent, co stanowi poważne zagrożenie.
W podatności CVE-2025-68897 występuje niewłaściwa kontrola generacji kodu, co prowadzi do możliwości wstrzyknięcia kodu w wtyczce IF AS Shortcode w wersjach od n/a do 1.2. Problem ten może być wykorzystany przez atakujących do wykonania nieautoryzowanego kodu.
An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component.
A vulnerability in D-Link DIR-600 up to 2.15WWb02 affects an unknown functionality of the file hedwig.cgi in the HTTP Header Handler component. Manipulation of the Cookie argument results in a stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an "instanceof" expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.
File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
WMPro developed by Sunnet has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.
W wersji 0.0.60 systemu Eigent zidentyfikowano podatność na zdalne wykonanie kodu (RCE) przy użyciu jednego kliknięcia. Ta podatność umożliwia atakującemu wykonanie dowolnego kodu na maszynie lub serwerze ofiary.
FreshRSS prior to version 1.28.0 uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking.
StreamVault to rozwiązanie do integracji pobierania wideo. Przed wersją 251126 występuje podatność na zdalne wykonanie kodu (RCE) w aplikacji stream-vault (SpiritApplication), która pozwala administratorom na konfigurowanie argumentów yt-dlp bez odpowiedniej walidacji.
n8n from version 1.0.0 to before 2.0.0 has a sandbox bypass vulnerability in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process.
Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS