CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unknown vulnerability in the remshd daemon on HP-UX B.11.00, B.11.11, and B.11.23 running in Trusted Mode allows remote attackers to gain unauthorized system access via unknown attack vectors.
SQL injection vulnerability in the report module of ibProArcade 2.5.2 and earlier. Remote attackers can execute arbitrary SQL commands via the 'user' parameter in index.php.
A SQL injection vulnerability was found in the index.php file of Peel versions 2.6 through 2.7. Remote attackers can execute arbitrary SQL commands via the rubid parameter.
In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.
A buffer overflow vulnerability in FileZilla Server Terminal 0.9.4d allows remote attackers to cause a denial of service (terminal crash) by sending a long USER FTP command.
The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer.
Vulnerability in QDBM before version 1.8.33-r2 allows local users in the portage group to escalate privileges by placing a shared object in the Portage temporary build directory, which is added to the search path allowing it to be loaded at runtime.
Vulnerability in Java Runtime Environment (JRE) and Software Development Kit (SDK) versions 1.4.2_08, 1.4.2_09, 1.5.0_05 and possibly others allows remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object, such as a font object as demonstrated on JBoss.
SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum parameter.
Vulnerability in ImageMagick before version 6.2.4.2-r1 allows local users in the portage group to escalate privileges by placing a shared object in the Portage temporary build directory, which is added to the search path allowing it to be loaded at runtime.
PHP file inclusion vulnerability in index.php of OSTE 1.0 allows remote attackers to execute arbitrary code via the 'page' and 'site' parameters.
Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in conjunction with the login/userinfo.php path and the session parameter (aka the PHPKITSID variable).
The suid.cgi scripts in F-Secure Internet Gatekeeper for Linux before version 2.15.484 and Anti-Virus Linux Gateway before version 2.16 are installed with SUID permissions and world-executable, allowing local users to escalate privileges.
SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.
Macromedia Flash plugin (Flash.ocx 7.0.19.0 and earlier for Windows, libflashplayer.so before 7.0.25.0 for Unix) is vulnerable to a crash and potential arbitrary code execution via a crafted SWF file. The issue occurs when calling ActionDefineFunction in ActionScript, leading to improper memory access.
SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields in adminlogin.asp.
Vulnerability in GDAL before version 1.3.0-r1 allows local users in the portage group to escalate privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.
The envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.
A vulnerability in Zone Labs (ZoneAlarm) software allows remote attackers to bypass the 'Advanced Program Control and OS Firewall filters' setting using URLs in HTML Modal Dialogs (window.location.href) embedded in JavaScript tags.