CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free (UAF) vulnerability was found in the location service module. Successful exploitation may affect service availability.
A race condition vulnerability was found in the location service module. Successful exploitation may affect service availability.
A permission control vulnerability was found in the WLAN module. Successful exploitation may affect service confidentiality.
A Denial of Service (DoS) vulnerability was found in the file parsing module. Successful exploitation may affect service availability.
A buffer overflow vulnerability exists in the file preview module. Successful exploitation of this vulnerability may affect availability.
A permission control vulnerability exists in the Optimizer module. Successful exploitation of this vulnerability may affect service confidentiality.
A permission control vulnerability was found in the event notification management module. Successful exploitation may affect service confidentiality.
A null pointer dereference vulnerability exists in the ArkWeb module. Successful exploitation of this vulnerability may affect availability.
A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.
A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.
A permission control vulnerability exists in the graphics module. Successful exploitation of this vulnerability may affect confidentiality.
A permission control vulnerability exists in the background task management module. Successful exploitation of this vulnerability may affect service integrity.
A DoS vulnerability exists in the file parsing module. Successful exploitation of this vulnerability may affect availability.
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4, affecting the _get_tpl_content function in dayrui/Fcms/Library/Notice.php within the Email Template Rendering component. The manipulation leads to code injection, and the attack can be initiated remotely. The exploit is publicly available and might be used; the vendor did not respond to the disclosure.
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4, affecting the View function in dayrui/Fcms/Core/View.php within the Member Module component. Manipulating the catid argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the patch is identified as 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231.
A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. APIs exposed through the WSO2 API Manager's API Gateway are not affected.
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. The lock condition is only applied to the secondary user store account, allowing continued authentication attempts against the primary user store account. This flaw enables brute force attacks.
A vulnerability was found in the WAVLINK WN551X3-A device in the system function of /bin/ioos, within the WireGuard CLI Group Handler component. Manipulating the group_name argument leads to OS command injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
A flaw was found in the CloudClassroom-PHP-Project in an unknown function of manageassessment2.php. Manipulating the ExamName/Q1/Q2/Q3/Q4/Q5 arguments causes cross-site scripting, and the attack can be carried out remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS