CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via unspecified vectors that are not properly handled in a syslog function call.
A buffer overflow vulnerability in SWS Web Server 0.1.7 allows remote attackers to execute arbitrary code by sending a long HTTP request.
Multiple SQL injection vulnerabilities exist in misc.php of MySmartBB 1.1.x. Remote attackers can manipulate the id and username parameters to execute arbitrary SQL commands.
A directory traversal vulnerability in Magic ISO 5.0 Build 0166 allows remote attackers to write arbitrary files by using a '..' sequence in a filename within an ISO image.
A directory traversal vulnerability in PowerISO 2.9 allows remote attackers to write arbitrary files by using a '..' (dot dot) sequence in a filename within an ISO image.
A PHP remote file inclusion vulnerability in Thumbnail AutoIndex before version 2.0 allows an attacker to execute arbitrary PHP code via README.html or HEADER.html parameters.
A vulnerability in parser.exe of Océ 3121/3122 printers allows remote attackers to cause a denial of service (crash or reboot) via a long request, potentially triggering a buffer overflow.
SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).
A buffer overflow vulnerability in JuniperSetupDLL.dll, loaded by JuniperSetup.ocx in the Juniper SSL-VPN Client when connecting to a Juniper NetScreen IVE device running vulnerable IVE OS versions, allows remote attackers to execute arbitrary code via a long ProductName parameter.
A buffer overflow vulnerability in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code by sending a long argument to the EHLO, MAIL FROM, and RCPT TO commands.
In rsync before version 2.6.8, an integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) may allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
Multiple unspecified vulnerabilities in FITELnet products (F40, F80, F100, F120, F1000, E20/E30) allow remote attackers to cause a denial of service (DoS) via crafted DNS messages that trigger errors in ProxyDNS or PKI-Resolver. The vulnerability was demonstrated using the OUSPG PROTOS DNS test suite.
A buffer overflow vulnerability was discovered in pdnsd before version 1.2.4 with unknown impact and attack vectors. This issue may be related to the OUSPG PROTOS DNS test suite.
An unspecified vulnerability in Juniper Networks JUNOSe E-series routers before version 7-1-1, related to the DNS client code, can be exploited remotely. The issue was identified by the OUSPG PROTOS DNS test suite.
SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. This issue can be leveraged to execute arbitrary PHP code by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.
SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.
Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101 and other versions allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.
The na-img-4.0.34.bin software for the IP3 Networks NetAccess NA75 has a default administrative account with username and password set to 'admin'.
Multiple SQL injection vulnerabilities were found in ampleShop 2.1 and earlier. An attacker can remotely execute arbitrary SQL commands via the RecordID, solus, and cat parameters in various .cfm files.
Multiple SQL injection vulnerabilities were found in the osTicket module in Help Center Live before version 2.1.0. They allow remote attackers to execute arbitrary SQL commands via unknown vectors.