CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Lilac-Reloaded w wersji 2.0.8 dla Nagios zawiera podatność na zdalne wykonanie kodu w funkcji autodiscovery, która pozwala atakującym na wstrzykiwanie dowolnych poleceń. Wykorzystując brak filtrowania wejścia w parametrze nmap_binary, atakujący mogą wykonać powłokę zwrotną, wysyłając odpowiednio skonstruowane żądanie POST do punktu końcowego autodiscovery.
A vulnerability in TOTOLINK T10 4.1.8cu.5083_B20200521 affects the sprintf function in the file /cgi-bin/cstecgi.cgi. Manipulation of the argument loginAuthUrl leads to a stack-based buffer overflow. The attack can be performed remotely.
Dive is an open-source MCP Host Desktop Application. A critical Stored XSS vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows execution of arbitrary JavaScript via `javascript:`. An attacker can inject a malicious MCP server configuration, leading to RCE on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue.
An issue in GT Edge AI Community Edition versions before v2.0.12 allows attackers to execute arbitrary code by injecting a crafted JSON payload into the Prompt window.
Galette is a membership management web application for non-profit organizations. Prior to version 1.2.0, while updating any existing account with a self-forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
Punkty końcowe usługi Glutton V1 były dostępne bez jakiejkolwiek autoryzacji w stosach Gotham, co mogło umożliwić użytkownikom bez odpowiednich uprawnień bezpośredni dostęp do backendu glutton i możliwość odczytu, aktualizacji lub usunięcia danych. Usługa została załatana i automatycznie wdrożona we wszystkich instancjach Gotham zarządzanych przez Apollo.
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Podatność CVE-2025-1928 dotyczy systemu zamówień online firmy Restajet Information Technologies Inc. i polega na niewłaściwym ograniczeniu nadmiernych prób uwierzytelnienia, co umożliwia wykorzystanie funkcji odzyskiwania hasła.
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. It affects both mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. Even after deleting those configurations, if a branch office VPN to a static gateway peer remains, the Firebox may still be vulnerable.
Weblate to narzędzie do lokalizacji oparte na sieci. W wersjach przed 5.15.1 istniała możliwość zdalnego nadpisania konfiguracji Git oraz zmiany niektórych jego zachowań. Wersja 5.15.1 naprawia ten problem.
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
Elevation of privilege vulnerability in Custom Question Answering.
Buffer overflow vulnerability in sc_device_msg_deserialize() in Genymobile/scrcpy up to version 3.3.3. A compromised device can send crafted messages causing out-of-bounds reads, potentially leading to memory corruption or denial of service.
OS command injection vulnerability in EasyPHP Webserver 14.1. Unauthenticated attackers can execute arbitrary system commands by sending crafted POST requests to /index.php?zone=settings with the app_service_control parameter.
Dify up to version 1.5.1 includes default PostgreSQL credentials (username and password) in its docker-compose.yaml file. The vendor reports that PostgreSQL is not exposed on TCP port 5432 by default since version 1.0.1.
Podatność CVE-2025-64236 w AmentoTech Tuturn umożliwia obejście uwierzytelniania poprzez alternatywną ścieżkę lub kanał. Problem ten dotyczy wersji Tuturn przed 3.6.
Zidentyfikowano słabość w urządzeniu Tenda WH450 w wersji 1.0.0.18, która dotyczy nieznanej funkcji pliku /goform/onSSIDChange w komponencie obsługi żądań HTTP. Manipulacja argumentem ssid_index prowadzi do przepełnienia bufora na stosie.
Critical authentication bypass vulnerability in Ollama platform's API endpoints up to v0.12.3. Multiple API endpoints are exposed without authentication, allowing remote attackers to perform unauthorized model management operations.
CORS misconfiguration vulnerability in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: The supplier disputes this, arguing that credentialed requests do not provide additional access compared to unauthenticated requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS