CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in VERITAS Backup Exec 9.0 through 10.0 for Windows Servers and 9.0.4019 through 9.1.307 for Netware allows a remote attacker to cause a denial of service (Remote Agent crash) by sending a crafted packet to the NDMLSRVR.DLL library or a packet with an invalid (non-zero) 'Error Status' value, leading to a null pointer dereference.
Vulnerability in VERITAS Backup Exec Server (beserver.exe) versions 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106.
SQL injection vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the iMsg parameter to messages.asp, iFor parameter to post.asp or forums.asp, or id parameter to userEdit.asp. Vectors 1 and 3 were later reported to affect version 3.0.
Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the iCat, iSub, iPro, and iType parameters in various ASP scripts.
Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the iChannel, iData, iMem, iCat, offset, and iChannel parameters.
Multiple SQL injection vulnerabilities in DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the iCat, iPro, and iSub parameters.
PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the User Name field (sUserName parameter) or Password (sPassword parameter).
Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the iState parameter in default.asp or the iPro parameter in edit.asp.
SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Multiple SQL injection vulnerabilities in Fortibus CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via (1) the username or password to logon.asp, (2) WeeklyNotesDisplay.asp, or (3) the Search page.
Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the ci, d, or m parameter to index.asp, or the bi parameter to blog_comment.asp.
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the username or id parameters.
The XMLRPC server in the Ruby library (libruby) 1.8 sets an invalid default value that prevents security protection using handlers, allowing remote attackers to execute arbitrary commands.
Stack-based buffer overflow in VERITAS Backup Exec Remote Agent for Windows and Netware. An attacker can remotely execute arbitrary code by sending a specially crafted CONNECT_CLIENT_AUTH request with a long password.
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
The vulnerability in amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
The vulnerability in Enterasys Vertical Horizon VH-2402S switches before firmware version 2.05.05.09 consists of a hard-coded debugging account and password, allowing a remote attacker to gain elevated privileges.
Directory traversal vulnerability in InteractivePHP FusionBB .11 Beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the language parameter.