CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Apple Mac OS X 10.3.9 and 10.4.6, the bundle API in CoreFoundation loads dynamic libraries even if the client application has not directly requested it. This allows attackers to execute arbitrary code from an untrusted bundle.
A buffer overflow in QuickTime Streaming Server on Apple Mac OS X 10.3.9 and 10.4.6 occurs when processing a crafted RTSP request during message logging. This allows a remote attacker to execute arbitrary code.
MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the provided 'New MySQL root password', leaving the MySQL root password blank. This allows local users to gain full privileges to that database.
A heap-based buffer overflow in Apple QuickTime before version 7.1 in the ReadBMP function allows remote attackers to execute arbitrary code via a crafted BMP file. This issue was originally part of CVE-2006-1983 but is now a separate CVE.
In vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, a remote attacker can authenticate to an account that does not have a cleartext password set by using a blank password for SMTP AUTH or APOP.
IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.
The vulnerability in the Verisign VUpdater.Install (i-Nav) ActiveX control allows a remote attacker to execute arbitrary executable files without verifying Microsoft Cabinet (.CAB) files.
PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges and view and configure log files via a direct request to the admin.php or settings.php pages.
Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors related to stored procedure calls.
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier. An attacker can execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.
The vulnerability in Ideal Science Ideal BB 1.5.4a and earlier is due to an incomplete blacklist of file extensions. An attacker can upload and execute an ASP script using a .asa file, which bypasses the check for the .asp extension but is executable on the server.
The vulnerability in 180solutions Zango software downloads required adware components without integrity or authenticity checks. This allows context-dependent attackers to execute arbitrary code by subverting DNS resolution of static.zangocash.com.
A Cross-Site Scripting (XSS) vulnerability in moreinfo.asp of EPublisherPro allows remote attackers to inject arbitrary web script or HTML via the title parameter. The details are obtained solely from third party information.
SQL injection vulnerability in admin_default.asp of DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the Login or password fields.
SQL injection vulnerability in admin_default.asp of OzzyWork Galeri allows remote attackers to execute arbitrary SQL commands via the Login or password fields.
Multiple integer overflows in the DPRPC library (DPRPCW32.DLL) of Novell Client 4.83 SP3, 4.90 SP2 and 4.91 SP2 allow remote attackers to execute arbitrary code via an XDR encoded array with a field specifying a large number of elements, triggering overflows in the ndps_xdr_array function.
Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the CatID, SubjectID, and Pic parameters.
In Sophos Anti-Virus products before versions 5.2.1 and 4.05, when cabinet file inspection is enabled, a remote attacker can execute arbitrary code via a CAB file with invalid folder count values, leading to heap corruption.
A directory traversal vulnerability in the Quake 3 engine allows remote attackers to read arbitrary files from the server. The issue occurs when the sv_allowdownload cvar is enabled and an attacker sends a .pk3 file request containing ".." sequences.
A critical vulnerability in Microsoft Distributed Transaction Coordinator (MSDTC) allows remote attackers to execute arbitrary code by sending a crafted request with a long fifth argument to the BuildContextW or BuildContext opcode. The heap-based buffer overflow in msdtcprx.dll enables remote code execution without authentication.