CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
A vulnerability in Gadu-Gadu 7.20 allows a remote attacker to cause a denial of service (DoS) by sending multiple DCC packets with code 6 or 7. This triggers a large number of popup windows and creates an excessive number of threads, leading to system overload.
A vulnerability in Apple Safari 2.0.2 allows remote attackers to cause a system slowdown via a JavaScript BODY onload event that calls the window function.
A stack-based buffer overflow in Gadu-Gadu 7.20 occurs when processing an image filename between 192 and 200 characters, as the "imgcache\" string appended to the buffer is not accounted for, allowing remote attackers to cause a denial of service (crash).
A vulnerability in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and configuration loss) via a page with a large number of gg: URIs.
A vulnerability in Mozilla browser allows a remote attacker to cause a denial of service (DoS) via excessive CPU consumption. The attack exploits a JavaScript BODY onload event that calls the window function.
A memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service by sending multiple DCC packets with a code other than 2 and a large size field, which allocates memory for the packet but does not free it after the packet has been dropped.
Unspecified vulnerability in Cisco Security Agent (CSA) 4.5.0 and 4.5.1 agents, when running on Windows systems, allows local users to bypass protections and gain system privileges by executing certain local software.
Multiple SQL injection vulnerabilities in K-Search 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the term, id, stat, and source parameters to index.php, and through the image parameters with an add request.
Enterprise Connector 1.0.2 and earlier contain multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the messageid parameter in send.php or a delete action in messages.php.
SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameter.
SQL injection vulnerability in netzbr.php in Netzbrett 1.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the p_entry parameter in an entry command to index.php.
Multiple SQL injection vulnerabilities in Softbiz Resource Repository Script 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sbres_id parameter in details_res.php, refer_friend.php, and report_link.php, and the sbcat_id parameter in showcats.php.
Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the folder_id parameter in list.php and the mid parameter in a view action to messages.php.
SQL injection vulnerability in search.php in AtlantisFAQ Knowledge Base Software 2.03 and earlier allows remote attackers to execute arbitrary SQL commands via the searchStr parameter.
Buffer overflow vulnerability in unalz before version 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.
Stack-based buffer overflow in ktools library 0.3 and earlier, used in products such as centericq, orpheus, motor, and groan, allows local or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.
PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
A PHP remote file inclusion vulnerability in athena.php of Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.
PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.