CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in cosmicshop/search.php of CosmicShoppingCart allows remote attackers to execute arbitrary SQL commands via the max parameter.
Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, distinct from CVE-2006-2480.
A stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack vectors.
The ping.php script in Russcom.Ping allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the domain parameter.
SQL injection vulnerability in the search script of AlstraSoft Web Host Directory 1.2 (also known as HyperStop WebHost Directory 1.2) allows remote attackers to execute arbitrary SQL commands via the uri parameter.
In Vixie cron 4.1, the do_command.c file does not check the return code of a setuid call. If setuid fails (e.g., due to PAM errors or resource limits), a local user could potentially gain root privileges.
In DSChat 1.0, the Nickname field is not sanitized before creating a file in a user directory, allowing a remote attacker to execute arbitrary PHP code. The vulnerability was reported by a third party and details are unknown.
In RWiki versions 2.1.0pre1 through 2.1.0, the editing form contains a vulnerability allowing remote execution of arbitrary Ruby code. Attackers can exploit unknown attack vectors to take control of the server.
The snmp_trap_decode function in the SNMP NAT helper in Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that trigger failures in snmp_trap_decode, leading to frees of random memory or double-free by snmp_trap_decode and its calling function, as demonstrated by certain test cases of the PROTOS SNMP test suite.
SQL injection vulnerability in links.php of 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board. Remote attackers can execute arbitrary SQL commands via the cat parameter.
Multiple unspecified vulnerabilities in Software Distributor on HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allow local users to gain privileges via unspecified attack vectors.
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS["CLPath"] parameter to reconfig.php and srxclr.php. This may be due to a globals overwrite issue.
An unspecified vulnerability in HP OpenView Storage Data Protector 5.1 and 5.5 allows remote attackers to execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in HP OpenView Network Node Manager (OV NNM) versions 6.20, 6.4x, 7.01, and 7.50 allow remote attackers to gain privileged access, execute arbitrary commands, or create arbitrary files via unknown vectors.
A stack-based buffer overflow in PDF Form Filling and Flattening Tool before version 3.1.0.12 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long field names.
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the author_id parameter in profile.php and the aut_id parameter in userarticles.php. Invalid SQL manipulation via the aut_id vector may also result in path disclosure.
A vulnerability in PostgreSQL allows attackers to bypass SQL injection protections by using invalid encodings of multibyte characters. Affected versions include 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier.
PostgreSQL vulnerability allows bypassing SQL injection protection in applications using multibyte encodings (SJIS, BIG5, GBK, GB18030, UHC). The issue stems from improper handling of the 0x5c (backslash) byte as the trailing byte of a multibyte character by clients that do not support these encodings.
The Edimax BR-6104K router has a vulnerability in UPnP handling that allows remote attackers to bypass access restrictions and perform unauthorized operations. By modifying the InternalClient parameter in a UPnP request, an attacker can add port forwarding rules (AddPortMapping) and redirect arbitrary network traffic.
In Sitecom WL-153 router firmware before version 1.38, a vulnerability exists due to missing validation of the InternalClient parameter in UPnP requests. A remote attacker can bypass access restrictions and perform unauthorized operations, such as forwarding arbitrary traffic via AddPortMapping.