CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The CC: Tweaked mod for Minecraft prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 does not blacklist metadata API endpoints by default on popular cloud hosting providers like AWS, GCP, and Azure. This allows players to access sensitive information, potentially leading to privilege escalation within the cloud provider.
The OpenComputers mod for Minecraft has a vulnerability that allows players to access sensitive information from cloud metadata services when the Internet Card feature is enabled. This affects versions from 1.2.0 to 1.8.3 in default configurations.
The TOTOLINK A3300R device in version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
A command injection vulnerability was discovered in the TOTOLINK A3300R device version V17.0.0cu.557_B20221024 via the ip parameter in the setDiagnosisCfg function.
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 has been found to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
In TravianZ versions 8.3.4 and 8.3.3, incorrect access control in the installation script allows an attacker to overwrite the server configuration and inject PHP code.
In TravianZ versions 8.3.4 and 8.3.3, there is a vulnerability related to the use of a cryptographically insecure random number generator in the password reset function. This allows an attacker to guess the password reset parameters and take over user accounts.
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
A command injection vulnerability was discovered in Tenda AC10 v15.03.06.26 via the mac parameter in the function formWriteFacMac.
PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.
CVE-2023-37245 describes a buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.
Vulnerability in the atcmdserver module allows interception of commands from the modem. Attackers may exploit this vulnerability to rewrite NVRAM or facilitate the exploitation of other vulnerabilities.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS