CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerabilities in Zen Cart before version 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to other attempted exploits than SQL injection.
Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via specially crafted m3u or pls files with long URLs ending in .wma or long filenames.
In sNews 1.3, the index.php file is vulnerable to SQL injection via the category and id parameters. This allows a remote attacker to execute arbitrary SQL commands on the database.
A double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.
Zen Cart before version 1.2.7 does not protect the admin/includes directory, allowing remote attackers to cause unknown impact via unspecified vectors, likely direct requests.
A buffer overflow vulnerability in Metamail 2.7-50 occurs when processing a long 'boundary' attribute in email messages. An attacker can send a crafted email causing a denial of service or potentially arbitrary code execution.
TTS Time Tracking Software 3.0 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in Zen Cart before version 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the change_password.php script does not verify the old password when a user changes the password. This allows a remote attacker to change the password without knowing the old one, potentially leading to unauthorized access.
In Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier, the add_user.php script does not check user privileges when adding a new administrative user. This allows a remote attacker to create an admin account without authorization.
In Virtual Hosting Control System (VHCS) version 2.4.7.1 and earlier, the check_login function in login.php does not exit after authentication failure. This allows a remote attacker to gain unauthorized access to the system.
A format string vulnerability in powerd.c of Power Daemon (powerd) version 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.
The LDAP component in Fedora Directory Server 1.0 is vulnerable to a denial of service attack via a crafted BER sequence that causes a free of uninitialized memory, leading to a server crash. The issue was demonstrated using the ProtoVer LDAP test suite.
Heap-based buffer overflow in the bitmap processing routine of Microsoft Windows Media Player. A crafted BMP file with size 0 but containing extra data allows remote attackers to execute arbitrary code.
A vulnerability in Microsoft Windows XP SP1/SP2 and Server 2003 up to SP1 allows a remote attacker to cause a system hang by sending an IGMP packet with an invalid IP option. This is known as the IGMP v3 DoS vulnerability.
A buffer overflow vulnerability in the plug-in for Microsoft Windows Media Player 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.
A vulnerability in the ShellAbout API call of the Korean Input Method Editor (IME) in Windows XP SP1/SP2, Windows Server 2003 up to SP1, and Office 2003 allows a local user to gain privileges by launching the "shell about dialog box" and clicking the End-User License Agreement link, which executes Notepad with the privileges of the program displaying the about box.
A vulnerability in telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.
Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before version 1.0.06. Impact and attack vectors are unknown.
Multiple SQL injection vulnerabilities exist in Magic Calendar Lite 1.02 in cms/index.php via the $total_login and $total_password parameters when magic_quotes_gpc is disabled. Remote attackers can execute arbitrary SQL commands.