CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Compuware DriverStudio Remote Control service (DSRsvc.exe) versions 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.
SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.
A stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.
A buffer overflow vulnerability in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code by sending a long USER name.
A buffer overflow vulnerability in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.
The vulnerability in the miniserv.pl script in Webmin before version 1.230 and Usermin before version 1.160, when 'full PAM conversations' is enabled, allows a remote attacker to bypass authentication by spoofing session IDs using certain metacharacters (line feed or carriage return).
Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in different scripts.
Multiple SQL injection vulnerabilities in vBulletin before version 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.
A stack-based buffer overflow vulnerability exists in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server 6.0 (all build 6.0.0.383). A remote attacker can exploit a long filename in an ACE archive to execute arbitrary code.
Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via various parameters in scripts like announcement.php, thread.php, user.php, and others.
Multiple unspecified vulnerabilities have been discovered in the WYSIWYG editor in PHP-Nuke before version 7.9 Final. Their impact and attack vectors are unknown.
Vulnerability in Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes.
In SGI IRIX 6.5.25, 6.5.26, and 6.5.27, the rpc.mountd service incorrectly grants access to anonymous clients whose hostname cannot be determined. This issue occurs in a security mechanism, but there is no apparent attacker role and it probably does not satisfy the CVE definition of a vulnerability.
SQL injection vulnerability in Interakt MX Shop 3.2.0 allows remote attackers to execute arbitrary SQL commands via the idp, id_ctg, or id_prd parameters to the pages module in index.php.
SQL injection vulnerability in index.php in NooTopList 1.0.0 release 17. Remote attackers can execute arbitrary SQL commands via the 'o' or 'sort' parameters.
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.
A vulnerability in Helpdesk Software Hesk allows remote attackers to bypass authentication for admin.php and admin_main.php by modifying the PHPSESSID session ID parameter or cookie.
A direct static code injection vulnerability in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.