CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in masqmail before version 0.2.18 allows remote attackers to execute arbitrary commands via crafted email addresses that are not properly sanitized when creating a failed delivery message.
A buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before version 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.
Firefox 1.0.6 and Mozilla 1.7.10 contain a vulnerability that allows arbitrary command execution via a URL with shell metacharacters passed to the browser on the command line, which is sent unfiltered to bash.
Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec 5.3 before Hotfix 9 and StorageCentral 5.2 before Hot Fix 2 allow remote attackers to execute arbitrary code via certain ActiveX controls.
PHP Advanced Transfer Manager 1.30 has a default password for the administrator user, which allows remote attackers to upload and execute arbitrary PHP files.
SQL injection vulnerability in login.php in Digital Scribe 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
The v3flt2k.sys driver in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server does not properly validate the source of DeviceIoControl commands, allowing remote attackers to gain privileges.
SQL injection vulnerability in aeDating Script 4.0 and earlier. An attacker can inject arbitrary SQL statements via the Country parameter in search_result.php.
Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the tid, uid, and fid parameters in various scripts.
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes.
SQL injection vulnerability in index.php of phpoutsourcing Noah's classifieds allows remote attackers to execute arbitrary SQL commands via the rollid parameter.
SQL injection vulnerability in password_reminder.php in ATutor before version 1.5.1 pl1. A remote attacker can execute arbitrary SQL commands via the email field.
The vulnerability in pam_per_user before version 0.4 does not verify if the username changes between authentication attempts and uses the same subrequest handle, allowing remote or local attackers to log in as other users by using applications that allow username changes during authentication, such as /bin/login.
The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.
Stack-based buffer overflow in AVIRA Desktop for Windows version 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to execute arbitrary code via a long filename in an ACE archive.
Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include_once statement.
The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.
A buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
Buffer overflow vulnerability in apply.cgi in Linksys WRT54G routers versions 3.01.03, 3.03.6, and possibly others before 4.20.7. A remote attacker can exploit a long HTTP POST request to execute arbitrary code on the device.
The vulnerability in the ezconfig.asp file of the Linksys WRT54G router (versions 3.01.03, 3.03.6, and some configurations of 2.04.4) is due to the lack of an authentication initialization function. A remote attacker can obtain encrypted configuration information and, if the key is known, modify the configuration.