CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in the Decrypt::makeFileKey2 function in xpdf version 3.00 and earlier allows remote attackers to execute arbitrary code via a specially crafted PDF file with a large /Encrypt /Length keyLength value.
Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the EntryID or searchterm parameter to index.php, or username parameter to authenticate.php.
Vulnerability in ELOG before version 2.5.7 allows a remote attacker to bypass authentication and download a configuration file containing a sensitive write password via a modified URL.
Buffer overflow vulnerability in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command.
An unknown vulnerability in the remoteping service in remstats 1.0.13 and earlier allows remote attackers to execute arbitrary commands due to missing input sanitization.
Gigafast router (also known as CompUSA router) allows remote attackers to gain sensitive information and bypass the login page via a direct request to backup.cfg, which reveals the administrator password in plaintext.
A buffer overflow vulnerability in the Sentinel LM (Lservnt) service in Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by sending a large amount of data to UDP port 5093.
The vulnerability in Barracuda Spam Firewall 3.1.10 and earlier allows members of whitelisted domains to send mail to any domain, enabling the device to be used as an open mail relay for spam.
Vulnerability in consoleConnect.jsp in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter.
The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension.
The vulnerability in sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges by manipulating the autologinid value in a cookie.
phpMyAdmin 2.6.1 contains multiple PHP remote file inclusion vulnerabilities. An attacker can modify the 'theme' parameter in phpmyadmin.css.php or the 'cfg[Server][extension]' parameter in database_interface.lib.php to point to a remote server containing malicious code, leading to arbitrary PHP code execution.
SQL injection vulnerability in viewall.php and category.php of paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter in pafiledb.php.
Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to upload and potentially execute files outside the directory via the AttachmentsKey parameter to attachment.do, and delete arbitrary files via the select_file parameter to file.do.
The reportpost action in misc.php of PhotoPost PHP 5.0 RC3 does not limit the logging data sent to the administrator, allowing remote attackers to send large amounts of email to the administrator.
CoolForum 0.8.1 beta and earlier allows remote attackers to manipulate SQL commands via certain requests to alert.php or viewip.php, possibly due to a SQL injection vulnerability.
The kimgio library in KDE 3.4.0 contains a buffer overflow vulnerability when processing PCX image files. A remote attacker can exploit this by sending a crafted PCX file, potentially leading to arbitrary code execution.
A format string vulnerability in the SetImageInfo function in image.c in ImageMagick before version 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to the convert utility, which may be called by other web applications.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.