CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A directory traversal vulnerability in the FileSession object of Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
Aztek Forum 4.0 contains a vulnerability that allows a remote attacker to obtain sensitive information, such as usernames and passwords, by sending a "*/*" string in the msg parameter to index.php. This flaw exposes the data in a MySQL error message, possibly due to a forced SQL error or SQL injection.
The vulnerability in register.php in PunBB 1.2.10 allows an attacker to cause a Denial of Service (DoS) by flooding the system with new user registrations. This can overwhelm the server and make the forum unavailable.
SQL injection vulnerability in Invision Power Board (IPB) 2.1.5 in index.php during a showtopic operation. Remote attackers can execute arbitrary SQL commands via the st parameter.
A format string vulnerability in the visualization function in Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname, dedicated server name, or map name in a level (.lxl) file.
PHP-Stats 0.1.9.1 and earlier contains a directory traversal vulnerability via the option[language] and option[template] parameters in admin.php and other scripts. A remote unauthenticated attacker can read and potentially execute arbitrary files on the server.
PHP-Stats 0.1.9.1 and earlier contain a vulnerability in admin.php that allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
PHP-Stats 0.1.9.1 and earlier contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the option[prefix] parameter in admin.php and the PC_REMOTE_ADDR HTTP header in click.php.
Multiple buffer overflows in htpasswd, used in Acme thttpd 2.25b and possibly other products like Apache, may allow local users to gain privileges via a long command line argument or a long line in a file.
SQL injection vulnerability in forgotten_password.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
The vulnerability in kpdf results from incomplete application of patches from xpdf related to CVE-2005-3627. This allows attackers to exploit flaws that were not fully fixed.
A vulnerability in htpasswd used in Acme thttpd 2.25b and possibly other products like Apache allows local users to gain privileges via shell metacharacters in command line arguments passed to the system function.
An unspecified vulnerability in the session handling of Geeklog versions 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.
SQL injection vulnerability in Akarru Social BookMarking Engine before version 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter in akarru.lib/users.php.
Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier. Unknown impact and attack vectors.
An unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostic tests via unknown attack vectors.
SQL injection vulnerability in Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Multiple buffer overflows in LISTSERV 14.3 and 14.4 (including Lite and HPO) with the web archive interface enabled allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.
An eval injection vulnerability in the decode function of rpc_decoder.php in phpRPC 0.7 and earlier, used by runcms, exoops, and other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.
Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier are related to permissions. Their impact and attack vectors are unknown.