CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter in a manageaccount action to index.php.
Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, NetBSD-2 before 20050913, and NetBSD-1.6 before 20050914. Local users can cause heap corruption, system crash, and potentially gain root privileges.
Multiple unspecified vulnerabilities in the web utility function in Hitachi Cm2/Network Node Manager and JP1/Cm2/Network Node Manager before September 30, 2005 allow attackers to execute arbitrary commands, disable services, and exploit other vulnerabilities.
A stack-based buffer overflow in the as_bad function in messages.c in GNU Binutils before July 21, 2005 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.
SQL injection vulnerability in poll_frame.php of Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.
A stack-based buffer overflow in TUGZip 3.4.0.0 occurs when processing a long filename in an ARJ archive. Remote attackers can exploit this to execute arbitrary code.
A buffer overflow vulnerability exists in the reset_vars function in config/tc-crx.c of the GNU as (gas) assembler in GNU Binutils before July 14, 2005. This flaw can be exploited via a crafted .s file, potentially leading to unknown impacts.
The SISCO OSI stack for Windows, used in MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service (process crash) via certain network traffic, as demonstrated using a Nessus scan.
An untrusted search path vulnerability (RPATH) in XnView 1.70 and NView 4.51 on Gentoo Linux allows local users to execute arbitrary code via a malicious library in the current working directory.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.
A format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before version 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code by injecting format strings into the wprintw function.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including the m parameter in auth.php, the f parameter in events.php, or the e parameter in plug.php.
A buffer overflow vulnerability in MTink from the printer-filters-utils package allows local users to execute arbitrary code by setting a long HOME environment variable.
SQL injection vulnerability in check_user.asp in multiple Web Wiz products (Site News 3.06 and earlier, Journal 1.0 and earlier, Polls 3.06 and earlier, Database Login 1.71 and earlier) allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.
The ath_rate_sample function in the sample code of MadWifi before version 0.9.3 allows remote attackers to cause a denial of service (system crash due to failed KASSERT) by moving a connected system to a location with low signal strength, and possibly other vectors related to a race condition between interface enabling and packet transmission.
Multiple SQL injection vulnerabilities exist in PHP-Nuke 7.8 in modules.php via the name, sid, and pid parameters in POST requests when magic_quotes_gpc is disabled. Attackers can bypass GET request security checks and execute arbitrary SQL commands.
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
In Net-SNMP versions 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, running in master agentx mode, the snmp_api.c function in snmpd contains a denial of service vulnerability. A remote attacker can crash the daemon by causing a specific TCP disconnect, which triggers a free of an incorrect variable.