CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username.
Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to admin_main.php.
Buffer overflow vulnerability in the Firewall Authentication Proxy for FTP and/or Telnet Sessions in Cisco IOS versions 12.2ZH, 12.2ZL, 12.3, 12.3T, 12.4, and 12.4T. A remote attacker can exploit crafted user authentication credentials to cause a denial of service (DoS) and potentially execute arbitrary code.
Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy).
PHP remote file inclusion vulnerability in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter in lang.php.
SQL injection vulnerability in login.php in myBloggie 2.1.3-beta and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
Multiple eval injection vulnerabilities in PlainBlack Software WebGUI before version 6.7.3 allow remote attackers to execute arbitrary Perl code via Help.pm, International.pm, or WebGUI.pm.
Multiple unknown vulnerabilities have been discovered in MAXdev MD-Pro version 1.0.72 and earlier, affecting modules: Download, Search, Web links, Blocks, Messages, News, Comments, Settings, Stats, and subjects. The impact and attack vectors are unspecified.
DownFile 1.3 allows remote attackers to gain administrator privileges via a direct request to update.php, del.php, and add_form.php.
Frox versions 0.7.16 and 0.7.17 improperly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts.
man2web allows remote attackers to execute arbitrary commands via -P arguments.
Multiple stack-based buffer overflows in urban before version 1.5.3 allow local users to gain privileges via a long HOME environment variable to config.cc, game.cc, highscor.cc, or meny.cc.
Frox 0.7.18, when running setuid root, does not properly drop privileges when reading a configuration file, which allows local users to read portions of arbitrary files via the -f command line option.
The vulnerability in kcheckpass in KDE 3.2.0 through 3.4.2 allows local users to gain root access via a symlink attack on lock files.
Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Vulnerability in mod_ssl before version 2.8.24, when 'SSLVerifyClient optional' is set in the global virtual host configuration, does not properly enforce 'SSLVerifyClient require' in a per-location context, allowing remote attackers to bypass intended access restrictions.
In the ext2 and ext3 file system code of Linux kernel 2.6, the xattr.c file incorrectly compares the name_index fields when sharing xattr blocks, which may prevent default ACLs from being applied.
Buffer overflow vulnerability in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to (1) events.php, (2) index.php, or (3) list.php.
SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.