CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Tenda AC7 V1.0, AC9 V3.0, and AC5 US devices were found to have a stack overflow vulnerability via the 'time' parameter at the URL /goform/PowerSaveSet.
Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were found to contain a stack overflow vulnerability via parameters startIp and endIp at url /goform/SetPptpServerCfg.
The Tenda AC9 V3.0 in version V15.03.06.42_multi was found to contain a stack overflow via the parameter firewallEn at the URL /goform/SetFirewallCfg.
Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were found to have a stack overflow vulnerability via the page parameter at the url /goform/NatStaticSetting.
Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg.
Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were found to contain a stack overflow vulnerability via parameter entries in the mitInterface at the url /goform/addressNat.
Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were found to have a stack overflow via parameter list at url /goform/SetIpMacBind.
Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
The Tenda AC9 V3.0 version V15.03.06.42_multi was found to contain a stack overflow via the wpapsk_crypto parameter at the URL /goform/WifiExtraSet.
Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were found to contain a stack overflow via parameter list at url /goform/SetStaticRouteCfg.
Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42_multi were found to contain a stack overflow via parameter ssid at url /goform/fast_setting_wifi_set.
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function.
An HTTP Request Tunneling vulnerability was found in Qlik Sense Enterprise for Windows affecting versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier. This allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request.
A vulnerability in TripSpark VEO Transportation and NovusEDU allows SQL injection through unsanitized POST parameters. Attackers can manipulate student busing information search queries.
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
An issue was discovered in FRRouting FRR 9.0, where bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
An issue was discovered in FRRouting FRR through 9.0 that allows reading the initial byte of the ORF header in an ahead-of-stream situation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS