CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service. Technical details are not yet available.
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via various parameters.
Multiple SQL injection vulnerabilities in NPDS 5.0 allow remote attackers to execute arbitrary SQL commands via the terme parameter in glossaire.php or the query parameter in links.php.
SQL injection vulnerability in SignIn.asp of India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password parameter.
SQL injection vulnerability in login.asp of an unknown product by Online Solutions for Educators (OS4E) allows remote attackers to execute arbitrary SQL commands via the password parameter.
A format string vulnerability in PeerCast 0.1211 and earlier allows remote attackers to execute arbitrary code via format strings in the URL.
Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp.
The filecopy function in misc.c in ClamAV before version 0.85 on Mac OS allows remote attackers to execute arbitrary code via a virus in a filename containing shell metacharacters, which are not properly handled when HFS permissions prevent file deletion and ditto is invoked.
Vulnerability in setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable.
D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensitive information.
A format string vulnerability in the imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
An integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5, 0.6, and versions before 0.6.90 allows remote attackers to execute arbitrary code via a partial message request with a large END parameter, leading to a heap-based buffer overflow.
Buffer overflow vulnerability in the header_get_field_name function in header.c of GNU Mailutils versions 0.5, 0.6, and earlier than 0.6.90. A remote attacker can execute arbitrary code via a crafted email.
A vulnerability in the D-Link DSL-504T router allows a remote attacker to bypass authentication and gain administrative privileges by making a direct request to the firmwarecfg resource. The attacker can then upgrade firmware, restart the device, or restore a saved configuration.
Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail Server 8.2 Hotfix 2, allow remote attackers to execute arbitrary code via a LOGIN command with a long username argument or a long username argument that begins with a special character.
The vulnerability in qpopper 4.0.5 and earlier versions is due to improper dropping of privileges before processing user-supplied files. A local user can exploit this flaw to overwrite or create arbitrary files with root privileges.
SQL injection vulnerability in login.asp of ezdwc NewsletterEz 3.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Stack-based buffer overflow in the IMAP daemon (IMAPD32.EXE) in IMail 8.13 and earlier versions before IMail Server 8.2 Hotfix 2 allows remote authenticated users to execute arbitrary code via a STATUS command with a long mailbox name.
Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and Remote Management allows remote attackers to execute arbitrary code via unspecified vectors, type 1 authentication requests, and type 2 authentication requests.
SQL injection vulnerability in admin.asp of FunkyASP AD System 1.1 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password parameter.