CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The log_query_dae.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
The vulnerability in dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to specified locations.
In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
The admin_sys_time.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.
IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
The Vivaldi installer for Windows prior to version 1.7.735.48 has an untrusted search path vulnerability that allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
Buffer overflow in Hoozin Viewer versions 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.
There is an untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, and other software versions. This allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
SEIL/x86 Fuji versions 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 and SEIL/X2 1.30 to 5.62, and SEIL/B1 1.00 to 5.62 are vulnerable to remote attacks that can cause denial of service via specially crafted IPv4 UDP packets.
There is an untrusted search path vulnerability in the installers of software for SDHC/SDXC Memory Cards with NFC and WLAN functionality. Remote attackers can gain privileges via a Trojan horse DLL placed in an unspecified directory.
Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
WN-G300R3 firmware version 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors.
Tablacus Explorer version 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
The installer of PhishWall Client for Internet Explorer version 3.7.13 and earlier has an untrusted search path vulnerability that allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2017-2128 allows remote attackers to execute arbitrary OS commands via specially crafted saved data in the security guide for website operators.
A privilege escalation vulnerability in the CentreCOM AR260S V2 allows remote authenticated attackers to gain higher privileges via the guest account.
CVE-2017-2120 describes an SQL injection vulnerability in WBCE CMS version 1.1.10 and earlier. It allows an attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.