CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
TOTOLINK A3300R router firmware v17.0.0cu.557 is vulnerable to Command Injection via the /cgi-bin/cstecgi.cgi CGI script. An attacker can remotely execute arbitrary system commands without authentication.
PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
Wtyczka RegistrationMagic dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 5.2.1.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Google, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
Wtyczka WP Visitor Statistics (Real Time Traffic) dla WordPressa w wersjach przed 6.9 nie zabezpiecza danych wejściowych użytkowników, które są łączone z zapytaniem SQL. To umożliwia nieautoryzowanym odwiedzającym przeprowadzanie ataków typu SQL Injection.
An authentication bypass vulnerability in the Optoma 1080PSTX C02 projector allows an attacker to access the administration console without valid credentials.
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Medical Systems Co. Medisys Weblab Products v19.4.03 contains a SQL injection vulnerability. The flaw exists in the WSDL files via the tem:statement parameter.
XWiki Platform prior to version 14.6-rc-1 did not check for dangerous attributes or attribute values during HTML rendering. This allowed cross-site scripting (XSS) attacks via attributes and link URLs supported in XWiki syntax. The issue is patched in XWiki 14.6-rc-1.
The Management Server component of affected Siveillance Video applications deserializes data without sufficient validation. An authenticated remote attacker could exploit this to execute code on the affected system.
The Event Server component of affected Siveillance Video applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web-based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.
Apache bRPC < 1.5.0 on all platforms allows attackers to execute arbitrary code via the ServerOptions::pid_file parameter. An attacker who can influence this parameter when starting the bRPC server can execute arbitrary code with the permissions of the bRPC process.
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
NS-ASG v6.3 was found to have a SQL injection vulnerability in the /admin/add_ikev2.php script. An attacker can exploit this flaw to manipulate database queries.
W systemie Online Food Ordering System v2.0 występuje podatność na przesyłanie dowolnych plików w komponencie /admin/ajax.php?action=save_menu, co pozwala atakującym na wykonanie dowolnego kodu poprzez przesłanie spreparowanego pliku PHP.
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for Windows, which contains improper permissions within the default installation. This vulnerability allows attackers to execute arbitrary code and gain escalated privileges.
GL.iNET MT3000 version 4.1.0 Release 2 is vulnerable to OS command injection via the /usr/lib/oui-httpd/rpc/logread endpoint. An attacker can remotely execute arbitrary commands on the system.
Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS