CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in handlers.c for Pico Server (pServ) before 3.3 may allow attackers to execute arbitrary code.
SQL injection vulnerability in the verify_email function in Woltlab Burning Board 2.x and earlier allows remote attackers to execute arbitrary SQL commands via the $email variable.
The pkt_ioctl function in the pktcdvd block device ioctl handler in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space and allows local users to cause a denial of service and possibly execute arbitrary code.
Multiple SQL injection vulnerabilities in JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via parameters such as anzahl_beitraege, year, tag, id, and the Accept-Language header.
Unknown vulnerability in Attachment Mod before version 2.3.13, related to a serious issue with realnames, has unknown impact and attack vectors.
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
SQL injection vulnerability in member.php in Photopost PHP Pro allows remote attackers to execute arbitrary SQL commands via the verifykey parameter.
The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X use the current working directory to find and execute the productname.sh script, which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.
The vulnerability in mod_channel.bas in ignitionServer 0.3.0 to 0.3.6 does not properly verify whether a host has the owner privileges required to delete IRC channel access entries, allowing remote attackers to bypass intended restrictions.
In the Linux kernel 2.6.x, raw character devices (raw.c) call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space. This vulnerability is similar to CVE-2005-1589.
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie password hash (pass_hash) that modifies the internal $pid variable.
A buffer overflow vulnerability in Apple iTunes before version 4.8 allows remote attackers to execute arbitrary code via a crafted MPEG4 file.
Unknown vulnerability in Sun StorEdge 6130 Arrays (SE6130) with serial numbers between 0451AWF00G and 0513AWF00J allows local users and remote attackers to delete data.
A mathematical flaw in the implementation of the El Gamal signature algorithm in LibTomCrypt versions 1.0 to 1.0.2 allows attackers to generate valid signatures without having the private key.
SQL injection vulnerability in catalog.php of CodeThat ShoppingCart 1.3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Vulnerability in phpBB before version 2.0.15 allows remote attackers to execute arbitrary script by injecting malicious code into BBcode tags. The bbencode_second_pass and make_clickable functions in bbcode.php do not properly filter URI schemes such as javascript:, applet:, about:, activex:, chrome:, or script:.
Pico Server (pServ) 3.2 and earlier allows local users to read arbitrary files as the pServ user via a symlink to a file outside of the web document root.
SQL injection vulnerability in login.asp of Net56 Browser Based File Manager 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.
Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via 'dirname/../cgi-bin' in a URL.
Vulnerability in viewforum.php in Ultimate PHP Board (UPB) versions 1.8 through 1.9.6 allows remote attackers to obtain sensitive information by providing an invalid 'id' or 'postorder' parameter, which reveals the system path in an error message when a file cannot be opened.