CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe.
SQL injection vulnerability in index.cfm of CFWebstore 5.0 allows remote attackers to execute arbitrary SQL commands via category_id, product_id, or feature_id parameters.
Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.
The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value.
SQL injection vulnerability in verify.asp of Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter.
An ActiveX control in McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages using the control's RegQueryValue() method.
Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 allows remote attackers to execute arbitrary code via an HTML message with long tag text.
SQL injection vulnerability in iWebNegar allows remote attackers to execute arbitrary SQL commands via the string parameter in index.php, comments.php, or the administrator login page.
Vulnerability in MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, improperly handles files with two file extensions, e.g., .php.rar, allowing remote attackers to upload and execute arbitrary code.
PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php.
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
Multiple vulnerabilities were found in the H.323 protocol implementation in First Virtual Communications products (Click to Meet Express, Premier, Conference Server, and V-Gate). A remote attacker can exploit these flaws to cause a denial of service (DoS), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
PHP remote file inclusion vulnerability in index.php of ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to reference a URL on a remote web server that contains a malicious funcs.php script.
Vulnerability in profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the value for an administrator.
An unknown security vulnerability was discovered in phpGroupWare before version 0.9.14.002 in the Setup/Config functionality. This vulnerability may be exploited via unknown attack vectors and lead to unspecified impacts.
Trend OfficeScan Corporate Edition 5.58 and possibly earlier does not drop privileges when opening a help window from a virus detection pop-up window, which allows local users to gain SYSTEM privileges.
Buffer overflow vulnerability in the sh_hash_compdata function in Samhain versions 1.8.9 through 2.0.1, when running in update mode ("-t update"), may allow attackers to execute arbitrary code.
The Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, improperly handles files with multiple extensions such as .php.rar, allowing remote attackers to upload and execute arbitrary code.
The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.
Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS