CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In ESET NOD32 before version 2.51.26, the 'restore to' selection in the 'quarantine a file' capability allows restoring a file to any directory that the user has read access to. This enables local users to create new files in directories where they lack write permissions.
SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.
In the vserver tool from util-vserver 0.30.209, when the suexec userid parameter is invalid and non-numeric, the command is executed as root. This may cause local users to inadvertently execute dangerous commands with root privileges.
Multiple buffer overflows exist in UltraVNC 1.0.1 and earlier and in tabbed_viewer 1.29. A malicious server can send a long string to a client on TCP port 5900, causing an overflow in Log::ReallyPrint and enabling remote code execution. Additionally, a long HTTP GET request on TCP port 5800 triggers an overflow in VNCLog::ReallyPrint, leading to a denial of service (server crash).
A PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.
Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules for ICMP and TCP protocols by sending IPv6 packets. However, this issue has been disputed, noting that ISA Server 2004 does not support IPv6 filtering.
An unspecified logical programming mistake in SMART SynchronEyes Student and Teacher 6.0 (and possibly earlier versions) allows remote attackers to cause a denial of service by sending a large packet to the Teacher discovery port (UDP 5496), terminating a thread and preventing communication on that port.
PHP remote file inclusion vulnerability in get_header.php of VWar 1.5.0 R12 and earlier. An attacker can supply a malicious URL in the vwar_root parameter, leading to arbitrary PHP code execution on the server.
A format string vulnerability in the Con_message and conPrintf functions in con_main.c of the Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in the JOIN command argument and possibly other command arguments.
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the id parameter in comments.php and the poll_id parameter in page.php.
The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, allowing remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.
A format string vulnerability in the SMTP server of McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code by sending a crafted email address containing format specifiers in the domain name. The flaw occurs when a bounce message is constructed without proper sanitization.
An unspecified vulnerability in Exponent CMS before version 0.96.5 RC 1, related to variables not being typecasted, allows remote attacks with unknown impact.
An unspecified vulnerability in the image module in Exponent CMS before version 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
An unspecified vulnerability in the banner module of Exponent CMS before version 0.96.5 RC 1 allows PHP injection via unknown attack vectors.
A remote file inclusion vulnerability exists in the VWar_Account module for PHPNuke Clan 3.0.1. Attackers can exploit the vwar_root2 parameter in includes/functions_common.php to include arbitrary files from external servers.
An unspecified vulnerability in VCEngine.php in v-creator before version 1.3-pre3, when the VC_CRYPTO_METHOD option is set to OPENSSL, allows remote attackers to execute arbitrary commands, likely due to issues in the encrypt and decrypt functions.
SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
A vulnerability in AN HTTPD 1.42n and earlier versions before 1.42p allows remote attackers to obtain source code of scripts by sending crafted requests containing dot and space characters in the file extension.
A buffer overflow in the is_client_wad_ok function in w_wad.cpp in Zdaemon 1.08.01 and X-Doom allows remote attackers to execute arbitrary code via a long filename argument.