CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.
An unspecified vulnerability in Java 1.3.1 before version 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain elevated privileges. The issue is related to Mac OS X specific extensions.
Multiple SQL injection vulnerabilities in digiSHOP 3.1.17 and earlier allow remote attackers to execute arbitrary SQL commands or obtain the full installation path via the 'c' parameter in cart.php and unspecified search module parameters.
A format string vulnerability in the Dopewars server before version 1.5.12, when running as an NT service, allows remote attackers to execute arbitrary code via unspecified attack vectors.
A vulnerability in NetBSD allows a local user to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials.
A stack-based buffer overflow in TUGZip 3.4.0.0 occurs when processing a long filename in an ARJ archive. Remote attackers can exploit this to execute arbitrary code.
An untrusted search path vulnerability (RPATH) in XnView 1.70 and NView 4.51 on Gentoo Linux allows local users to execute arbitrary code via a malicious library in the current working directory.
A buffer overflow vulnerability in MTink from the printer-filters-utils package allows local users to execute arbitrary code by setting a long HOME environment variable.
SQL injection vulnerability in check_user.asp in multiple Web Wiz products (Site News 3.06 and earlier, Journal 1.0 and earlier, Polls 3.06 and earlier, Database Login 1.71 and earlier) allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.
A CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, allowing remote attackers to read JSP source files and obtain sensitive information.
Unspecified vulnerability in Spey 0.3.3 related to multiple security holes that could lead to compromise. This issue is distinct from CVE-2005-4846.
The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings.
In IBM DB2 8.1 with Satellite Administration (SATADMIN) enabled, the SATENCRYPT function has a stack-based buffer overflow. A remote attacker can execute arbitrary code via a long parameter.
TYPO3 version 3.8.0 and earlier allows remote attackers to obtain sensitive information by directly requesting the misc/phpcheck/ directory, which invokes the phpinfo function and prints values of unspecified environment variables.
BugPort 1.147 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the devWherePair[0], orderBy, and where parameters.
An unspecified vulnerability in the multi-language environment library (libmle) in Solaris 7 and 8, shipped with the Japanese locale, allows local users to gain privileges via unknown attack vectors.
Geeklog before version 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
A vulnerability in BEA WebLogic Server and WebLogic Express versions 9.0, 8.1, and 7.0 locks out the admin account after multiple incorrect password guesses. A remote attacker who knows or guesses the admin account name can cause a denial of service (DoS) by blocking admin logins.
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, do not use the secure t3s protocol even when an Administration port is enabled on the Administration server. This could allow remote attackers to sniff the connection.