CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Hitachi Groupmax Mail SMTP versions 06-50 through 06-52-/A and 07-00 through 07-20 allows a remote attacker to stop the service by sending an email message with an invalid format.
A vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted pageid parameter to admin/versions.html.
Vulnerability in HP-UX versions B.11.00, B.11.04, B.11.11, and B.11.23 allows a remote attacker to perform a 'Rose Attack' by sending small IP fragments that do not form a complete packet, resulting in a denial of service (DoS).
SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the id, store, and step parameters.
SQL injection vulnerability in pafiledb.php in PHP Arena paFileDB Extreme Edition RC 5 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid and id parameters.
SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the step, id, and pid parameters.
An unspecified vulnerability in Hitachi Cosminexus Collaboration Portal, Groupmax Collaboration Portal, and Groupmax Collaboration Web Client allows a remote attacker to cause a denial of service by sending repeated invalid requests to the Schedule component.
SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter in forum.asp, Headforums.asp, and Subject.asp scripts.
Multiple unspecified vulnerabilities in Driverse before version 0.56b have unknown impact and attack vectors, related to (1) a 'ptrace exploit' and (2) 'some other potential security problems.'
The IKEv1 implementation in Apani Networks EpiForce 1.9 and earlier with IPSec enabled allows remote attackers to cause a denial of service (crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Due to lack of details, it is unclear which of CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668 applies.
SQL injection vulnerability in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter in index.php, which modifies the underlying $_SERVER variable.
SQL injection vulnerability in the search function in Plexum PLEXCART X3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly involving the s_itemname and s_orderby parameters to plexcart.pl.
SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the db_id parameter.
SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.
Vulnerability in index.php of ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.
SQL injection vulnerability in index.php of AlmondSoft Almond Personals 4.05 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php of AlmondSoft Almond Classifieds 5.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in ezUpload Pro 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.
Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, when compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response.
A heap-based buffer overflow in Citrix Program Neighborhood client version 9.0 and earlier allows remote attackers to execute arbitrary code by sending a long name value in an Application Set response.