CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność typu directory traversal w komponencie TS WebProxy w systemach Microsoft Windows umożliwia zdalnym atakującym uzyskanie wyższych uprawnień poprzez odpowiednio skonstruowaną ścieżkę w pliku wykonywalnym. Może to prowadzić do eskalacji uprawnień z niskiej integralności do średniej integralności.
A vulnerability in Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allows remote attackers to cause a denial of service through crafted username strings. This affects Internet Authentication Service (IAS) and Network Policy Server (NPS).
Buffer overflow in the Telnet service in Microsoft Windows systems, such as Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets.
The User Profile Service in Windows allows local users to gain elevated privileges by conducting a junction attack to load another user's UsrClass.dat registry hive.
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility components in Windows does not verify that an impersonation token is associated with an administrative account. This allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file.
SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids parameter.
A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long string in a UID command.
CVE-2014-100035 describes an SQL injection vulnerability in the admin interface of LicensePal ArcticDesk before version 1.2.5, allowing remote attackers to execute arbitrary SQL commands.
Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) version 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in download.php and main.php.
The mTouch Quiz before version 3.0.7 for WordPress has an SQL injection vulnerability in question.php that allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.
CVE-2014-100020 describes an SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 that allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter.
CVE-2014-100019 describes an SQL injection vulnerability in the LTree converter in Pomm before version 1.1.5, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.
Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a long string in specific opcodes to port 3000.
The Sendy application version 1.1.8.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the i parameter.
CVE-2014-100011 describes an SQL injection vulnerability in the /send-to module in Sendy 1.1.9.1 that allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
Multiple integer signedness errors in DirectShowDemuxFilter, used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, triggering a heap-based buffer overflow.
Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to edit_block.php, edit_cat.php, edit_note.php, or rmv_topic.php in admincp/.
The WP Symposium plugin version 14.11 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.