CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.
The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
An access control issue was discovered in NUUO software version v03.11.00. This vulnerability may allow an unauthorized user to bypass security mechanisms.
A remote command execution (RCE) vulnerability was discovered in D-Link DIR-820L version 1.05B03 via an HTTP POST request to the get set ccp function.
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Certain HP Print devices may be vulnerable to information disclosure, denial of service, or remote code execution.
Wtyczka Ninja Forms - File Uploads dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewystarczającej walidacji typu pliku wejściowego w pliku ~/includes/ajax/controllers/uploads.php. Atakujący mogą obejść tę walidację, co umożliwia przesyłanie złośliwych plików, które mogą prowadzić do zdalnego wykonania kodu.
Asus RT-AC68U before version 3.0.0.4.385.20633 and RT-AC5300 before version 3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. This vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service.
A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges; Apple is aware of a report that this issue may have been actively exploited.
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
An SQL Injection vulnerability in Attendance and Payroll System v1.0 allows a remote attacker to bypass authentication via unsanitized login parameters.
A Remote Code Execution (RCE) vulnerability in Sourcecodester Attendance and Payroll System v1.0 allows an unauthenticated remote attacker to upload a malicious PHP file via the photo upload functionality.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
A command injection vulnerability exists in TOTOLINK A3100R up to version V4.1.2cu.5050_B20200504 in the adm/ntm.asp script via the hosTime parameter. It allows a remote attacker to execute arbitrary system commands on the device.
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS