CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and potentially execute arbitrary code via format string specifiers in the query string argument of an HTTP GET request.
A vulnerability in Kerio MailServer before version 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.
A buffer overflow vulnerability in qmailadmin.c in QmailAdmin before version 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.
In RedBLoG 0.5, the rss.php file contains an SQL injection vulnerability via the cat_id parameter. A remote attacker can execute arbitrary SQL commands.
Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long parameter name or value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.
A PHP remote file inclusion vulnerability in OWL Intranet Engine 0.82 via the xrms_file_root parameter in lib/OWL_API.php, when register_globals is enabled, allows remote attackers to include arbitrary files from external servers.
A PHP remote file inclusion vulnerability in archive.php of Fantastic News 2.1.2 (and reportedly 2.1.4) allows attackers to include arbitrary remote files via the CONFIG[script_path] variable. This flaw can be exploited to execute arbitrary PHP code from an external source.
A buffer overflow vulnerability in Tenes Empanadas Graciela (TEG) 0.11.1 occurs when an underscore is automatically appended to duplicate nicknames. An attacker can create multiple users with long, identical nicknames, triggering an off-by-one error and causing the application to crash.
SQL injection vulnerability in show.php in vbzoom 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter. The SubjectID vector is already covered by CVE-2005-4729.
SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.
A buffer overflow vulnerability in RevilloC MailServer and Proxy 1.21 when processing the USER command allows remote attackers to execute arbitrary code.
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
A PHP remote file inclusion vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the 'pg' parameter.
Kaspersky Antivirus 5.0.5 and 5.5.3 contain a vulnerability that allows a remote attacker to cause a denial of service via excessive CPU and memory consumption. The attack vector is unknown.
SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter in info_db.php or database.php.
SQL injection vulnerability in news.php in NMDeluxe before version 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. It is unclear whether this report is associated with a specific product.
Pixelpost 1.5 beta 1 and earlier contain multiple SQL injection vulnerabilities. An attacker can remotely execute arbitrary SQL commands via the showimage parameter in index.php and the USER_AGENT, HTTP_REFERER, and HTTP_HOST HTTP headers in the book_vistor function in includes/functions.php.
A buffer overflow vulnerability in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, derived from the Cube engine, allows remote attackers to execute arbitrary code via long input data streams.
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the informationID or ParentCategory parameter to index.php. This could lead to unauthorized database access.