CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Saho's attendance devices ADM100 and ADM-100FP have insufficient filtering for special characters and file types within their file uploading function. This allows an unauthenticated remote attacker to upload and execute arbitrary files, potentially performing arbitrary system commands or disrupting service.
Saho's attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data.
SpotCam Sense has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary system commands or disrupt service.
SpotCam FHD 2 by SpotCam Co., Ltd. has a vulnerability related to the use of hard-coded uBoot credentials. A remote attacker can exploit this vulnerability to gain access to the system to perform arbitrary system operations or disrupt service.
The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to perform command injection attacks or disrupt service.
The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that contains a vulnerability due to hard-coded Telnet credentials. A remote unauthenticated attacker can exploit this vulnerability to gain access to the system and perform arbitrary system operations or disrupt services.
In versions 0.2.3 and prior, the weblogic-framework tool does not verify returned data packets, leading to a deserialization vulnerability. This may result in remote code execution when the tool deserializes data returned by the server without verification.
Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
CVE-2023-4420 allows a remote unprivileged attacker to intercept communication with SICK LMS5xx devices due to the absence of TLS security. This can lead to unauthorized disclosure of sensitive information and data manipulation.
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and/or disrupt the functionality of the device.
A stack overflow was discovered in Tenda AC10 v4 related to the parameters macFilterType and deviceList at the endpoint /goform/setMacFilterCfg.
The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow vulnerability due to improper handling of parameter list and bindnum at the /goform/SetIpMacBind endpoint.
The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow vulnerability via the macFilterType and deviceList parameters at the URL /goform/setMacFilterCfg.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetNetControlList.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability due to improper handling of the macFilterType and deviceList parameters at /goform/setMacFilterCfg.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the timeZone parameter at the /goform/SetSysTimeCfg endpoint.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the mac parameter at /goform/GetParentControlInfo.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability due to improper handling of parameter list and bindnum at the /goform/SetIpMacBind endpoint.
The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetVirtualServerCfg.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS