CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unquoted Windows search path vulnerability in Kaspersky Anti-Virus 5.0 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.
A vulnerability in the gdk-pixbuf library of GTK+ before version 2.8.7 allows an attacker to cause an infinite loop via a crafted XPM image with a large number of colors, leading to a denial of service (DoS).
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.
Multiple directory traversal vulnerabilities in Tikiwiki before version 1.9.1 allow remote attackers to read arbitrary files and execute commands via the suck_url parameter to tiki-editpage.php or the language parameter to tiki-user_preferences.php.
Vulnerability in iTunesHelper.exe in iTunes 4.7.1.30 and iTunes 5 for Windows due to an unquoted Windows search path. A local user can exploit a malicious C:\program.exe file to escalate privileges.
An integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values.
Stack-based buffer overflow in a shared library used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5.1 up to MP3A allows remote attackers to execute arbitrary code via a crafted packet.
An unquoted Windows search path vulnerability in VMWare Workstation 5.0.0 build-13124 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.
Lynx versions before 2.8.6dev.15 allow remote attackers to execute arbitrary system commands via lynxcgi:, lynxexec, and lynxprog links, which are not properly restricted in the default configuration in some environments.
Unquoted Windows search path vulnerability in RealPlayer allows local users to gain privileges via a malicious C:\program.exe file.
An unquoted Windows search path vulnerability in Microsoft Antispyware 1.0.509 (Beta 1) might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder, involving the programs GIANTAntiSpywareMain.exe, gcASNotice.exe, gcasServ.exe, gcasSWUpdater.exe, or GIANTAntiSpywareUpdater.exe.
The CodeSupport.ocx ActiveX control, used by Sony to uninstall the First4Internet XCP DRM, has 'safe for scripting' enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.
Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in category.php and info.php.
The vulnerability in the PNP_GetDeviceList (upnp_getdevicelist) function in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows a remote attacker to cause a denial of service (DoS) through excessive memory consumption. The attack involves sending a DCE RPC request with a large output buffer size.
Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in logout.php and index.php.
Vulnerability in IBM Informix Dynamic Database server on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username.
PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitrary files via the 'file' parameter, possibly due to a directory traversal vulnerability.
Multiple buffer overflows in the IMAP Groupware Mail server of Floosietek FTGate (FTGate4) 4.1 allow remote attackers to execute arbitrary code via long arguments to various IMAP commands, as demonstrated with the EXAMINE command.
Vulnerability in Oracle Databases running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication by supplying a valid username.
IBM DB2 database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account without supplying a password.