CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in news.php of Utopia News Pro (UNP) 1.1.3. A remote attacker can execute arbitrary SQL queries via the newsid parameter when magic_quotes_gpc is disabled and register_globals is enabled.
A format string vulnerability in the input_cdda.c file of the xine-lib library allows remote CDDB servers to execute arbitrary code via specially crafted metadata in server responses when a victim plays a CD.
Stack-based buffer overflow in PWIWrapper.dll for Webroot Desktop Firewall before 1.3.0build52 allows local users to execute arbitrary code as SYSTEM by sending a crafted DeviceIoControl command, then removing an allowed program from the firewall list.
Multiple SQL injection vulnerabilities in aradmin.asp for aspReady FAQ allow remote attackers to execute arbitrary SQL commands, possibly via the (1) txtLogin and (2) txtPassword parameters.
In XMail before version 1.22, a stack-based buffer overflow in the sendmail function allows a remote attacker to execute arbitrary code by providing a long -t command line option.
A stack-based buffer overflow in the ntlm_output function in http-ntlm.c for wget 1.10, curl 7.13.2, and libcurl 7.13.2, and other products using libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.
A buffer overflow vulnerability exists in the mail_valid_net_parse_work function in mail.c of Washington's IMAP Server (UW-IMAP) before imap-2004g. A remote attacker can exploit a mailbox name containing a single double-quote character without a closing quote, causing indefinite copying of bytes into a buffer.
A buffer overflow vulnerability in Computer Associates (CA) iGateway versions 3.0 and 4.0 before 4.0.050623, when running in debug mode, allows remote attackers to execute arbitrary code via crafted HTTP GET requests.
The mod_auth_shadow module versions 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
A vulnerability in the Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code due to an unchecked buffer when processing certain crafted network messages.
A buffer overflow vulnerability in Collaboration Data Objects (CDO) in Microsoft Windows and Microsoft Exchange Server allows a remote attacker to execute arbitrary code by sending an email message with a long header name, such as the "Content-Type" string.
Format string vulnerability in the bpjava-msvc daemon (Java user interface service) in VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, and NetBackup Enterprise/Server/Client 5.0, 5.1, and 6.0. A remote attacker can exploit this flaw to execute arbitrary code by sending a specially crafted COMMAND_LOGON_TO_MSERVER command.
A vulnerability in the COM+ service in Microsoft Windows due to improper creation and use of memory structures allows local or remote attackers to execute arbitrary code.
A vulnerability in the runpriv tool in SGI IRIX allows local users to bypass intended restrictions and execute arbitrary commands via shell metacharacters in a command line for a privileged binary in /usr/sysadm/privbin.
Vulnerability in Ruby (versions 1.6.x to 1.6.8, 1.8.x to 1.8.2, and 1.9.0 development up to 2005-09-01) allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).
The vulnerability in Mason before version 1.0.0 is that after configuring a firewall using this tool, the init script is not installed. As a result, the firewall is not activated after a system reboot.
The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists (ACLs) on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the template.
Multiple SQL injection vulnerabilities in PHP-Fusion before version 6.00.110 allow remote attackers to execute arbitrary SQL commands via the activate parameter in register.php and the cat_id parameter in faq.php.
Multiple SQL injection vulnerabilities were found in the photogallery.php script in PHP-Fusion. A remote attacker can manipulate the 'album' and 'photo' parameters to execute arbitrary SQL commands on the database.
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the pm_email_notify and pm_save_sent parameters. This is a different vulnerability than CVE-2005-3157 and CVE-2005-3159.