CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in PHP-Fusion before version 6.00.110 allow remote attackers to execute arbitrary SQL commands via the activate parameter in register.php and the cat_id parameter in faq.php.
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 causes the IP address of a Terminal Services client not to be recorded in the security log after a successful connection. This makes it easier for attackers to evade detection.
A vulnerability in Microsoft Windows 2000 before Update Rollup 1 for SP4 allows a local administrator to unlock a computer even if it has been locked by a domain administrator, enabling the local administrator to access the session as the domain administrator.
A buffer overflow vulnerability in the W3C logging of MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code.
Format string vulnerability in the logging functionality in BitDefender AntiVirus 7.2 through 9 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in file or directory name.
Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.
The vulnerability in login.php of myBloggie 2.1.3 beta and earlier allows an attacker to bypass a whitelist check using a null character in the username parameter, enabling SQL injection. Although the whitelist check succeeds, the null character injects SQL into the query.
Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execute arbitrary code via format strings in filenames.
The vulnerability in Procom NetFORCE 800 version 4.02 M10 Build 20 (and possibly other versions) causes the NIS password map (passwd.nis) to be sent as a file attachment in diagnostic email messages, allowing remote attackers to obtain cleartext NIS password hashes.
Heap-based buffer overflow in Kaspersky Antivirus 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arbitrary code via a CAB file with large records after the header.
Buffer overflow vulnerability in the get_string_ahref function of ProZilla 1.3.7.4 and possibly earlier versions, with the -ftpsearch option enabled. A remote server can execute arbitrary code by sending a crafted string in the HREF field of an <A> tag in a search response.
Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login field.
Vulnerability in Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy restrictions by downloading the launch.ica file and changing the client device name (ClientName).
Buffer overflow vulnerability in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename.
Buffer overflow vulnerability in the getconf tool in IBM AIX versions 5.2 through 5.3 allows a local user to execute arbitrary code via unknown vectors.
Buffer overflow vulnerability in the ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long third argument to the GotNate.Excute method.
The ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to download and execute arbitrary programs by setting the arguments to the GotNate.Excute method.
The Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.