CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in Groove Virtual Office before version 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attackers to bypass restrictions on COM objects.
Vulnerability in D-Link routers allows authentication bypass when executing /cgi-bin/firmwarecfg. An attacker can gain unauthorized access if their IP address is already in /var/tmp/fw_ip or if they are the first requester, which creates the file with their IP address.
The vulnerability in episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.
Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php, (2) tid parameter to view.php, fid parameter to (3) download.php or (4) chat_download.php, (5) status parameter to icon.php, TICKET_tid parameter to (6) index.php or (7) view.php.
Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).
The vulnerability in ppxp is that the program does not drop root privileges before opening log files, allowing local users to execute arbitrary commands.
SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via group_membership_query, simul_count_query, or simul_verify_query configuration entries.
In Woppoware PostMaster 4.2.2 (build 3.2.5), the message.htm file contains a directory traversal vulnerability. A remote attacker can determine the existence of arbitrary files on the server by providing a '..' sequence in the wmm parameter.
Vulnerability in YusASP Web Asset Manager 1.0 allows remote attackers to gain elevated privileges via a direct request to assetmanager.asp.
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as the IP of the logged in user, which allows remote attackers to conduct FTP Bounce attacks to bypass firewall rules or cause a denial of service.
The vulnerability in Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, allowing remote attackers to obtain and decrypt usernames and passwords.
The vulnerability in HTMLJunction EZGuestbook involves storing the guestbook.mdb file under the web document root with insufficient access control. A remote attacker can access this file and obtain sensitive information, including the administrative password.
Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via the Folder.Id parameter to (1) deletefolder.ctml, (2) deletemessage.ctml, (3) origmessage.ctml, or (4) readmessage.ctml, the Message.Id parameter to editmessage.ctml, or the (5) Message.Command parameter to messages.ctml.
Vulnerability in message.htm in Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter.
Gurgens (GASoft) Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords.
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, or a long SSI command.
SQL injection vulnerability in Sigmaweb.DLL in Sigma ISP Manager 6.6 allows remote attackers to execute arbitrary SQL commands via the username, password, or domain fields.
Unknown vulnerability in Attachment Mod before version 2.3.13, related to a serious issue with realnames, has unknown impact and attack vectors.
Multiple SQL injection vulnerabilities in JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via parameters such as anzahl_beitraege, year, tag, id, and the Accept-Language header.