CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The tuxpaint-import.sh script in Tux Paint version 0.9.14 and earlier creates temporary files insecurely, which may lead to unknown impacts and attack vectors.
Multiple SQL injection vulnerabilities in PHPSurveyor before version 0.991 allow remote attackers to execute arbitrary SQL commands via the sql parameter in browse.php and the sid, lid, gid, and token parameters in other PHP scripts.
Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 are vulnerable to a denial of service attack via a long crafted string sent to port 7800 (GUI Server) or 7801 (Device Server), causing server components to crash or hang, though they are automatically restarted.
Buffer overflow in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E. A remote attacker can exploit crafted IKE packets, potentially leading to unspecified impacts, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter. This is a different vulnerability than CVE-2005-3875.
Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form.
In Plogger Beta 2, the file plog-admin-functions.php contains a PHP remote file inclusion vulnerability. An attacker can execute arbitrary code by providing a URL in the config[basedir] parameter.
IKEv1 implementations in FortiOS, FortiClient, and FortiManager allow remote attackers to cause a denial of service by sending IKE packets with invalid IPSec attribute values. The attack terminates a process that is automatically restarted.
Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the GroupsId and ItemsId parameters in admin.php.
A format string vulnerability in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E may allow a remote attacker to cause an unknown impact by sending crafted IKE packets containing format string specifiers, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Multiple format string vulnerabilities in FTGate 4.4 POP3 (USER, PASS, TOP) and IMAP (LIST, AUTHENTICATE) commands allow remote attackers to execute arbitrary code via crafted format specifiers.
A stack-based buffer overflow in index.fts of FTGate 4.4 (Build 4.4.000 Oct 26 2005) allows remote attackers to execute arbitrary code via a long tzoffset value.
Electric Sheep 2.6.3 does not require authentication or integrity checks between server and client, allowing remote attackers to download and display arbitrary MPEG files via DNS spoofing, command-line URL, or configuration file URL. The description notes similar attack vectors apply to web browsers, questioning its specificity.
An unspecified vulnerability in the GTP dissector of Ethereal versions 0.9.1 through 0.10.13 allows remote attackers to cause an infinite loop, resulting in a denial of service (DoS). The attack can be carried out via unknown vectors.
The vulnerability in rssh versions 2.0.0 through 2.2.3 allows local users to bypass access restrictions and gain root privileges by using the rssh_chroot_helper command to chroot to an external directory.
A vulnerability in the Windows GDI32.DLL library allows remote code execution via a crafted WMF image with a SETABORTPROC GDI Escape call, affecting the Picture and Fax Viewer (SHIMGVW.DLL). This flaw was originally exploited in the wild on unionseek.com.
SQL injection vulnerability in the user area of RWS Statistics Counter before version 2.4.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the cat parameter in openforum.php and getfile.php, and the target parameter in download_now.php.
A buffer overflow vulnerability exists in Golden FTP Server 1.92 when handling the APPE command. Remote attackers can exploit this to execute arbitrary code on the server.
In eggblog 2.0, the search.php file mishandles the q parameter, allowing an attacker to disclose the full server path. This issue may be related to an SQL injection vulnerability.