CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in includes/common.php in RunCMS 1.2 and earlier uses the extract function with EXTR_OVERWRITE on HTTP POST variables, allowing remote attackers to overwrite arbitrary variables, potentially leading to arbitrary code execution.
SQL injection vulnerability in the Downloads module of PostNuke 0.760-RC4b allows administrators to execute arbitrary SQL commands via the 'show' parameter in dl-viewdownload.php.
PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the SITE_Path parameter to menu_dx.php or CONTENTS_Dir parameter to menu_sx.php.
Vulnerability in Mantis 0.19.0a1 through 1.0.0a3 in core/database_api.php, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses.
A vulnerability in the gorum/prod.php script in Zorum 3.5 allows remote attackers to execute arbitrary code by injecting shell metacharacters into the argv parameter.
A buffer overflow vulnerability in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Jtext field.
Vulnerability in Computer Associates Message Queuing (CAM/CAFT) versions 1.05, 1.07 before build 220_13, and 1.11 before build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
A buffer overflow in the mutt_decode_xbit function in Handler.c of Mutt 1.5.10 may allow remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
An integer overflow in pcre_compile.c in PCRE before version 6.2 allows attackers to execute arbitrary code via crafted quantifier values in regular expressions, leading to a heap-based buffer overflow.
An unknown vulnerability in the Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to bypass authentication.
The vulnerability in Cisco Clean Access (CCA) versions 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 is due to improper user authentication when invoking API methods. A remote attacker can exploit this flaw to bypass security checks, change a user's assigned role, or disconnect users.
A buffer overflow vulnerability in the Log-SCR function of WinFtp Server 1.6.8 allows a remote attacker to cause a denial of service (application crash) and potentially execute arbitrary code via a long request.
SQL injection vulnerability in login_admin_mediabox404.php in mediabox404 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the User field.
Unknown vulnerability in pam_ldap before version 180 improperly handles a new password policy control, which could allow attackers to gain privileges.
A buffer overflow vulnerability in Chris Moneymaker's World Poker Championship 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long nickname.
Multiple SQL injection vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to execute arbitrary SQL commands via the Match or CatID parameter in SearchResults.php or the password in AccessControl.php.
SQL injection vulnerability in modcp.php in WoltLab Burning Board 2.2.2 and 2.3.3 allows remote authenticated attackers to execute arbitrary SQL commands via the x or y parameters.
The vulnerability in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 relies on AUTH_UNIX authentication, which uses user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM/CAFT) versions 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
Multiple PHP file inclusion vulnerabilities in PHPTB Topic Board 2.0 and earlier allow remote attackers to execute arbitrary PHP code via the absolutepath parameter.