CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-36187 describes a buffer overflow vulnerability in NETGEAR R6400v2 devices before version 1.0.4.118, allowing remote unauthenticated attackers to execute arbitrary code via a crafted URL to httpd.
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
Version 3.1.9 and earlier of smanga contains an SQL Injection vulnerability that allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
In versions of tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.
Improper access control exists in the GitHub repository usememos/memos prior to version 0.13.2.
The Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.
There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.
An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file.
CVE-2023-41636 describes a SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38, allowing attackers to access the database and execute arbitrary commands via a crafted SQL query.
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to and including 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin.
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input, leading to a command injection vulnerability.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the function 'sub_7D858'.
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'initIpAddrInfo' function. This function reads a user-provided parameter, and the variable is passed to the function without any length check.
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the function 'sub_34FD0'. This function reads user-provided parameters and passes variables to another function without length checks.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'formWifiBasicSet' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in function 'sub_73004'.
Tengda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'R7WebsSecurityHandler' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'add_white_node' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'fromGetWirelessRepeat' function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS