CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Administration Console in Secure Elements Class 5 AVR (C5 EVM) before version 2.8.1 does not enforce access control, allowing remote attackers to gain access to servers via the console.
The Secure Elements Class 5 AVR server (aka C5 EVM) before version 2.8.1 uses a hard-coded user ID and password, allowing remote attackers to gain access to the server.
A buffer overflow vulnerability exists in the addnewword function of typespeed version 0.4.4 and earlier. This flaw may allow remote attackers to execute arbitrary code via unknown vectors.
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request or invalid arguments to layout/professional/functions.php or getimage.php.
A directory traversal vulnerability in admin/admin_hacks_list.php in Nivisec Hacks List 1.20 and earlier for phpBB, with register_globals enabled, allows remote attackers to read arbitrary files via a '..' sequence in the phpEx parameter.
An unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in Cisco VPN Client for Windows versions 4.8.00.* and earlier, except for 4.7.00.0533, allows local authenticated, interactive users to gain privileges, possibly due to privileges of dialog boxes (bug ID CSCsd79265).
Geeklog 1.4.0sr2 and earlier versions contain an SQL injection vulnerability in the story submission mechanism. It allows a remote attacker to execute arbitrary SQL commands via unknown vectors.
Multiple PHP remote file inclusion vulnerabilities in EzUpload Pro 2.10 allow remote attackers to execute arbitrary PHP code by supplying a malicious URL in the 'path' parameter to form.php, customize.php, and initialize.php.
In EVA-Web 2.1.2 and earlier, an unspecified script (probably index.php) reveals the full web server path when invalid 'perso' or 'aide' parameters are passed.
Multiple SQL injection vulnerabilities exist in Tamber Forum 1.9.13 and earlier. Remote attackers can execute arbitrary SQL commands via various parameters in ASP scripts.
A PHP remote file inclusion vulnerability in V-Webmail 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter in includes/mailaccess/pop3/core.php.
WordPress 2.0.2 and earlier versions contain a direct static code injection vulnerability. An attacker can remotely execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which appends the code to files in cache directories.
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP code via a URL in the 'lang' parameter to business.php, credits.php, or help.php in the modules/credits directory.
A remote file inclusion vulnerability in V-Webmail 1.5 through 1.6.4 allows arbitrary PHP code execution via the CONFIG[pear_dir] parameter in includes/mailaccess/pop3.php. An attacker can inject a malicious URL to execute code.
A denial of service vulnerability exists in libs/comverp.c of Courier MTA before version 0.53.2. Unknown attack vectors using the '=' character in usernames cause excessive CPU consumption.
A stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might allow attackers to execute arbitrary code via a long filename.
A buffer overflow vulnerability exists in Alt-N MDaemon, possibly version 9.0.1 and earlier. A remote attacker can exploit a long A0001 argument starting with a double quote (") to execute arbitrary code.
An untrusted search path vulnerability in update_flash for IBM AIX 5.1, 5.2 and 5.3 allows local users to execute arbitrary commands via unknown vectors involving lsmcode and possibly other commands.
SQL injection vulnerability in cosmicshop/search.php of CosmicShoppingCart allows remote attackers to execute arbitrary SQL commands via the max parameter.
A remote file inclusion vulnerability in Plume 1.0.3 via the _PX_config[manager_path] parameter in manager/frontinc/prepend.php allows attackers to execute arbitrary PHP code.