CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unknown vulnerabilities in PROMS 0.11 allow non-authorized users to view or modify the project member list or modify the todos list.
Unknown vulnerability in MailScanner 4.41.3 and earlier, related to incomplete reporting of viruses in zip files, allows remote attackers to bypass virus detection.
GDB before version 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running GDB.
The vulnerability in BEA WebLogic Server and WebLogic Express versions 8.1 through Service Pack 3 and 7.0 through Service Pack 5 involves improper handling of exceptions thrown by a security provider. This may result in using an incorrect identity for the thread or failing to audit security exceptions.
A format string vulnerability in Warrior Kings: Battles 1.23 and earlier and Warrior Kings 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname.
Format string vulnerability in the logPrintBadfile function in delbadfiles.c in Iron Bars SHell (ibsh) before 0.3d allows users to access files outside the home directory and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.
Vulnerability in the fixproc tool of Net-snmp versions 5.x before 5.2.1-r1 causes insecure creation of temporary files. A local user can modify the contents of these files to execute arbitrary commands or overwrite arbitrary files via a symlink attack.
The vulnerability in PROMS version 0.11 is due to improper handling of certain combinations of rights, resulting in users being granted more privileges than intended.
SQL injection vulnerability in the Xanthia module for PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter in pnadmin.php.
An unknown vulnerability in ALWIL avast! antivirus version 4 (4.6.6230) and earlier, running on Windows NT 4.0, causes improper detection of certain viruses.
Integer overflow vulnerability in Computer Associates Vet Antivirus library allows remote attackers to gain elevated privileges by sending a crafted compressed VBA directory with a project name length of -1, leading to a heap-based buffer overflow.
SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in the News, File, Liens, or Faq modules.
Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.
Multiple SQL injection vulnerabilities in PROMS before version 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
A format string vulnerability in gxine versions 0.3 through 0.4.4 allows remote attackers to execute arbitrary code via a crafted RAM file where the URL hostname contains format string specifiers.
Unknown vulnerability in Serendipity 0.8, when used with multiple authors, allows unprivileged authors to upload arbitrary media files.
Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter.
Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows remote unauthenticated attackers to add a license.
PHP remote file inclusion vulnerability in common.php in phpATM 1.21 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the include_location parameter to index.php.
SQL injection vulnerability in wp-trackback.php in WordPress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.