CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in the Verisign VUpdater.Install (i-Nav) ActiveX control allows a remote attacker to execute arbitrary executable files without verifying Microsoft Cabinet (.CAB) files.
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier. An attacker can execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.
The vulnerability in Ideal Science Ideal BB 1.5.4a and earlier is due to an incomplete blacklist of file extensions. An attacker can upload and execute an ASP script using a .asa file, which bypasses the check for the .asp extension but is executable on the server.
The vulnerability in 180solutions Zango software downloads required adware components without integrity or authenticity checks. This allows context-dependent attackers to execute arbitrary code by subverting DNS resolution of static.zangocash.com.
Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors related to stored procedure calls.
PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges and view and configure log files via a direct request to the admin.php or settings.php pages.
Multiple integer overflows in the DPRPC library (DPRPCW32.DLL) of Novell Client 4.83 SP3, 4.90 SP2 and 4.91 SP2 allow remote attackers to execute arbitrary code via an XDR encoded array with a field specifying a large number of elements, triggering overflows in the ndps_xdr_array function.
A Cross-Site Scripting (XSS) vulnerability in moreinfo.asp of EPublisherPro allows remote attackers to inject arbitrary web script or HTML via the title parameter. The details are obtained solely from third party information.
SQL injection vulnerability in admin_default.asp of DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the Login or password fields.
Multiple SQL injection vulnerabilities in EImagePro allow remote attackers to execute arbitrary SQL commands via the CatID, SubjectID, and Pic parameters.
SQL injection vulnerability in admin_default.asp of OzzyWork Galeri allows remote attackers to execute arbitrary SQL commands via the Login or password fields.
In Sophos Anti-Virus products before versions 5.2.1 and 4.05, when cabinet file inspection is enabled, a remote attacker can execute arbitrary code via a CAB file with invalid folder count values, leading to heap corruption.
A directory traversal vulnerability in the Quake 3 engine allows remote attackers to read arbitrary files from the server. The issue occurs when the sv_allowdownload cvar is enabled and an attacker sends a .pk3 file request containing ".." sequences.
Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions. Local users and remote administrators can decrypt these passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.
Multiple SQL injection vulnerabilities in SaphpLesson 3.0 allow remote attackers to execute arbitrary SQL commands via the Find parameter in search.php and the LID and Rate parameters in misc.php.
The vulnerability in X-Scripts X-Poll (xpoll) 2.30 allows a remote attacker to upload an arbitrary PHP file via admin/images/add.php and then execute it by accessing the uploaded file.
A critical vulnerability in Microsoft Distributed Transaction Coordinator (MSDTC) allows remote attackers to execute arbitrary code by sending a crafted request with a long fifth argument to the BuildContextW or BuildContext opcode. The heap-based buffer overflow in msdtcprx.dll enables remote code execution without authentication.
Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files by providing an absolute path in the pfad parameter to index.php and galerie.php.
Multiple PHP remote file inclusion vulnerabilities in phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter in auth.php and auth_phpbb when phpBB portal is enabled, and via the smf_root_path parameter in auth.php and auth_SMF when SMF portal is enabled.
An unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via email messages with crafted vCal or iCal calendar properties.