CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability exists in multiple F-Secure Anti-Virus products for Windows and Linux when processing crafted ZIP archives. This allows remote attackers to execute arbitrary code on the affected system.
A buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code when the publisher's name link is clicked via a long publisher URI in a torrent file.
Etomite CMS 0.6 (and earlier) downloaded from the vendor site after January 10, 2006 contains a backdoor in manager/includes/todo.inc.php. Remote attackers can execute arbitrary commands via the 'cij' parameter.
A vulnerability in crawl before version 4.0.0 allows local users to gain privileges by unsafely calling programs when saving and loading games.
A heap-based buffer overflow in the encodeURI and decodeURI functions of the kjs JavaScript interpreter in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted UTF-8 encoded URI.
SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in login.php.
SQL injection vulnerability in login.php of aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
PDFdirectory before version 1.0 stores sensitive data in plaintext, allowing remote attackers to obtain arbitrary users' passwords via direct database queries, possibly through SQL injection vulnerabilities.
A buffer overflow in the YGPPicFinder.DLL ActiveX control in the AOL You've Got Pictures (YGP) Picture Finder Tool, used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.
Multiple SQL injection vulnerabilities were found in PDFdirectory before version 1.0 in files util.php, userpref.php, user.php, uploadfrm.php, title.php, team.php, stats.php, page.php, org.php, member.php, index.php, group.php, and anniv.php. These allow remote attackers to execute arbitrary SQL commands.
An integer overflow in the IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE occurs while scanning for wireless networks. Remote attackers can exploit this by broadcasting crafted beacon or probe response frames to execute arbitrary code.
BlogPHP 1.0 contains an SQL injection vulnerability in index.php when magic_quotes_gpc is disabled. An attacker can send a crafted query via the username parameter in a login action, allowing arbitrary SQL commands and authentication bypass.
SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.
Clipcomm CPW-100E and CP-100E devices with vulnerable firmware allow remote unauthorized access via the debug service on TCP port 60023.
Multiple unspecified vulnerabilities were found in Joomla! 1.0.5 and earlier, affecting the publishing component, Contact Component, TinyMCE Compressor, and other components. The impact and attack vectors are unknown.
A buffer overflow vulnerability in Dual DHCP DNS Server 1.0 exists in the DHCP options field. Remote attackers can exploit this to cause a denial of service (application crash) and potentially execute arbitrary code.
A remote file inclusion vulnerability exists in htmltonuke.php of the htmltonuke 2.0 alpha module for PHP-Nuke. Attackers can exploit the filnavn parameter to execute arbitrary PHP code from a remote URL.
Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10. The flaws affect the Oracle Workflow Cartridge component and have unspecified impact and attack vectors.
Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2 (9.0.4.2) in the Reorganize Objects & Convert Tablespace component. May lead to unknown security impacts.
Unspecified vulnerability in the Java Net component of Oracle Database Server and Application Server. May lead to unknown security impacts.