CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 versions 4.3.0.4 and 4.4.0.2. Remote attackers can execute arbitrary SQL commands via unspecified parameters.
Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.
Cross-site scripting (XSS) vulnerability in Cogent DataHub before version 7.3.5 allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
CVE-2014-2352 allows the directory specifier to be used to traverse the directory path, potentially enabling an attacker to access a limited number of hardcoded file types. Further exploitation may lead to a denial-of-service condition in the web server component.
Multiple untrusted search path vulnerabilities in setuid and setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
The Stored Procedure infrastructure in IBM DB2 versions 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet.
The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, making it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.
The vulnerability in Square Squash allows remote attackers to execute arbitrary code by manipulating a YAML document in the namespace or sourcemap parameters in the deobfuscation and sourcemap functions.
The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before version 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.
The WP ecommerce Shop Styling plugin for WordPress before version 1.8 contains a PHP remote file inclusion vulnerability in includes/generate-pdf.php, allowing attackers to execute arbitrary PHP code via the dompdf parameter.
Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via (1) username or (2) password.
Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 allow remote attackers to execute arbitrary SQL commands via the c[password] or c[username] parameter.
Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System before version 1.4(1i) and on various Nexus devices, allowing remote SMTP servers to execute arbitrary code via a crafted reply.
Unspecified vulnerability in HP Operations Manager versions 9.1 through 9.13 and 9.2 through 9.24 allows remote authenticated users to execute arbitrary code by leveraging the OMi operator role.
The Message Transfer Service (MTS) in Cisco NX-OS before version 6.2(7) on MDS 9000 devices and before version 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service through a large volume of crafted traffic, leading to NULL pointer dereference and kernel panic.
In Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, remote authenticated users can gain unintended privileges within a VDC via an SSH session to a management interface.
In Cisco NX-OS 6.1 before version 6.1(5) on Nexus 7000 devices, with local authentication and multiple VDCs enabled, remote authenticated users can gain unintended privileges within another VDC via crafted SSH key data in an SSH session to a management interface.
EMC Documentum D2 versions 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allow remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling a core method or a D2FS web-service method.
Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response.