CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft w3wp.exe does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET. A remote attacker can repeatedly request documents that refer to COM components or restricted documents under the ASP.NET application path, causing resource exhaustion or crash.
A vulnerability in Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and potentially execute arbitrary code via a crafted createTextRange call on a checkbox object, resulting in a dereference of an invalid table pointer.
A signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts that interrupt setjmp and longjmp function calls, modifying unexpected memory locations.
The vulnerability in avast! Antivirus 4.6.763 and earlier sets "BUILTIN\Everyone" permissions on critical system files in the installation folder. This allows local users to modify those files, potentially leading to privilege escalation or disabling the antivirus protection.
ASPPortal 3.1.1 and earlier contain multiple SQL injection vulnerabilities in various parameters, allowing remote attackers to execute arbitrary SQL commands. The vulnerabilities affect both unauthenticated users and administrators.
An unspecified vulnerability in FreeRADIUS 1.0.0 through 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) due to insufficient input validation in the EAP-MSCHAPv2 state machine module.
A remote file inclusion vulnerability exists in index.php of the 99Articles.com free articles directory. Attackers can exploit the 'page' parameter to include and execute arbitrary PHP code from a remote source.
A SQL injection vulnerability exists in loginfunction.php in gCards 1.45 and earlier. Remote attackers can execute arbitrary SQL commands via the username parameter.
X.Org server (xorg-server) versions 1.0.0 and later, X11R6.9.0, and X11R7.0 incorrectly treat the address of the geteuid function as the return value of a call to geteuid. This allows local users to bypass intended restrictions and execute arbitrary code via the -modulepath option or overwrite arbitrary files via -logfile.
The POP3 service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 contains a buffer overflow that allows a remote attacker to execute arbitrary code before authentication.
SQL injection vulnerability in events.php of Maian Events 1.0 allows remote attackers to execute arbitrary SQL commands via the month and year parameters.
Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter in friend.php or article.php.
In SoftBB 0.1, the reg.php file contains an SQL injection vulnerability via the mail parameter. This allows a remote attacker to execute arbitrary SQL commands on the database.
A heap-based buffer overflow in cURL and libcURL versions 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.
In rssh 2.3.0 on Debian GNU/Linux, the util.c file lacks braces to form a code block, causing the CVS check to always succeed. This allows rsync and rdist to bypass intended access restrictions defined in rssh.conf.
Multiple SQL injection vulnerabilities were found in Milkeyway Captive Portal 0.1 and 0.1.1. An attacker can inject malicious SQL code through parameters in auth.php, authuser.php, utils.php, traffic.php, userstatistics.php, and chgpwd.php scripts.
Multiple SQL injection vulnerabilities were found in Invision Power Board (IPB) versions 2.0.4 and 2.1.4 before 20060105. Remote attackers can execute arbitrary SQL commands via cookies by manipulating arrays of id/stamp pairs, keys in key/value arrays in ipsclass.php, the topics variable in usercp.php, and the topicsread cookie in topics.php, search.php, and forums.php.
A vulnerability in Beagle 0.2.2.1 due to an untrusted search path may allow a local user to gain privileges by placing a malicious beagle-info program in the current working directory or in directories specified in the PATH.
PHP remote file inclusion vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter.
PHP iCalendar 2.21 and earlier do not require authentication for write access to the calendars directory, allowing remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character.