CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in ISS BlackIce 3.6, used in multiple products, involves a failure to drop privileges before launching help from the 'More Info' button in the 'Application Protection' dialog. This allows local users to execute arbitrary programs as SYSTEM.
A vulnerability in NetBSD allows a local user to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials.
A vulnerability in util-vserver before version 0.30.208-1 and kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
A format string vulnerability in the vmps_log function in OpenVMPS 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. The vulnerability was reported by third parties and details are not fully verified.
SQL injection vulnerability in WebAdmin by RT Internet Solutions (RTIS) allows remote attackers to execute arbitrary SQL commands via the username and password fields.
In bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, a heap-based buffer overflow exists. A remote attacker can exploit this by sending invalid input sequences, leading to heap corruption and potentially causing a denial of service or arbitrary code execution.
Complete PHP Counter contains an SQL injection vulnerability in list.php. Remote attackers can execute arbitrary SQL commands via the c or s parameters.
SQL injection vulnerability in the Additional Images module for osCommerce before version 1.14. Remote attackers can execute arbitrary SQL commands via the products_id parameter in product_info.php.
An unspecified vulnerability in mroovca stats (mroovcastats) before version 0.4.5b related to cookies. Attackers can exploit unknown attack vectors, leading to an unspecified impact on the system.
SQL injection vulnerability in index.php of ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. The details are obtained solely from third party information as the original source is unavailable.
Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause a denial of service (crash) via the rlm_sqlcounter module or while expanding the %t token.
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
Buffer overflow vulnerability in BlueCoat WinProxy before version 6.1a and in the web console access functionality of ProxyAV before version 2.4.2.3. A remote attacker can exploit a long Host: header to execute arbitrary code.
SQL injection vulnerability in inc/function_upload.php in MyBB before 1.0.1. Remote attackers can execute arbitrary SQL commands via the file extension of an uploaded file attachment.
SQL injection vulnerability in index.php of 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter.
A buffer overflow in Nullsoft Winamp 5.094 allows remote attackers to execute arbitrary code via an m3u file containing a long line ending in .wma or a pls file containing a long File1 value ending in .wma.
Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView SDK before version 9.2.0, used in Lotus Notes 6.5.4 and 7.0, allow remote attackers to execute arbitrary code via specially crafted UUE, ZIP, TAR files or emails with long links.
An unspecified vulnerability in the multi-language environment library (libmle) in Solaris 7 and 8, shipped with the Japanese locale, allows local users to gain privileges via unknown attack vectors.
The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings.