CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in the termsh utility on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. This is likely a different vulnerability than CVE-2005-0351 as it involves a distinct attack vector.
SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter in search.php and the email parameter in user.php.
PHPjournaler 1.0 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the readold parameter.
CubeCart contains a PHP remote file inclusion vulnerability in includes/orderSuccess.inc.php, allowing an attacker to execute arbitrary PHP code by supplying a crafted URL in the glob[rootDir] parameter.
SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
A SQL injection vulnerability was found in VEGO Web Forum 1.26 and earlier in functions.php, functions_update.php, and functions_display.php. Remote attackers can execute arbitrary SQL commands via the theme_id parameter in index.php.
IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 contains a vulnerability that allows remote authenticated users to cause a denial of service (high CPU consumption) by abnormally terminating a connection, which prevents db2agents from being properly cleared.
A vulnerability in util-vserver before version 0.30.208-1 and kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
A vulnerability in NetBSD allows a local user to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials.
VirtueMart before version 1.0.1 improperly handles errors when a user is forbidden to read a requested page. This vulnerability may have unknown impact and can be exploited remotely.
SQL injection vulnerability in search.php of Free ClickBank 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the keywords parameter.
A vulnerability in the Xpdf library, used in many products (e.g., gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor), allows an attacker to cause an infinite loop (denial of service) by providing streams that end prematurely, such as CCITTFaxDecode or DCTDecode. This issue is known as 'Infinite CPU spins'.
A heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via words longer than the input buffer used by flex.
PHP remote file inclusion vulnerability in phpDocumentor 1.3.0 rc4 and earlier, when register_globals is enabled. Attackers can execute arbitrary code via URL in FORUM[LIB] or root_dir parameters.
SQL injection vulnerability in index.php of phpoutsourcing Zorum Forum 3.5 and earlier. Remote attackers can execute arbitrary SQL commands via the rollid parameter in the showhtmllist method.
Vulnerability in Xpdf library (Stream.cc) allows attackers to modify memory and potentially execute arbitrary code via specially crafted DCTDecode streams. The issue involves missing validation of values such as 'number of components', 'Huffman table index', and 'scanInfo.numComps' in functions DCTStream::readBaselineSOF, DCTStream::readProgressiveSOF, DCTStream::readHuffmanTables, and DCTStream::readScanInfo.
Drivers for certain display adapters, including an unspecified ATI driver and an unspecified Intel driver, may allow a remote attacker to cause a denial of service (system crash) via a large JPEG image. The attack was demonstrated in Internet Explorer using an image with dimensions of 9999999 pixels.
The vulnerability in Blue Coat Systems WinProxy before version 6.1a allows a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code by sending a large number of packets containing 0xFF characters to the Telnet port (TCP 23), which corrupts the heap.
Integer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified StripByteCounts or StripOffsets values.
An unspecified Accelerated Enterprise Solutions product, possibly Accelerated E Solutions, contains an SQL injection vulnerability in the password parameter. This allows remote attackers to execute arbitrary SQL commands.