CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-3376 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Digital Strategy Zekiweb system. This issue affects Zekiweb versions before 2.
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
CVE-2023-2963 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection in Oliva Expertise EKS versions before 1.2.
There is a prototype pollution vulnerability in the GitHub repository automattic/mongoose prior to version 7.3.4.
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in the changepwd.cgi application.
IQ Engine before version 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges for remote code execution.
The WAYOS FBM-291W version 19.09.11V was found to contain a command injection vulnerability via the component /upgrade_filter.asp.
The WAYOS FBM-291W version 19.09.11V was found to contain a buffer overflow vulnerability in the component /upgrade_filter.asp.
Netkit-rcp in rsh-client version 0.17-24 allows command injection via filenames because /bin/sh is used by susystem. This is related to issues described in CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.
XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.
A stack overflow was discovered in the page parameter in the function fromqossetting in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromSafeUrlFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromSafeMacFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromP2pListFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromSafeClientFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromDhcpListClient in Tenda F1202, FH1202, AC10, AC1206, AC7, AC5, and AC9 devices.
A stack overflow was discovered in the page parameter in the function fromNatStaticSetting in Tenda F1202, FH1202, AC10, AC1206, AC7, AC5, and AC9 devices.
A stack overflow was discovered in the page parameter in the function frmL7ProtForm in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
A stack overflow was discovered in the page parameter in the function fromRouteStatic in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.
The vm2 library, an advanced sandbox for Node.js, contains critical security issues and should not be used in production. In versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS