CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
A vulnerability in ReviewPost PHP Pro before version 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, bypassing intended restrictions.
Format string vulnerability in the chdev tool in IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
SQL injection vulnerability in the getwbbuserdata function in session.php in Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbitrary SQL commands via the userid or lastvisit cookie parameters.
A logic error in the CRAM-MD5 code of the UW-IMAP server, when CRAM-MD5 is enabled, does not properly enforce all required conditions for successful authentication, allowing remote attackers to authenticate as arbitrary users.
The vulnerability in NotifyLink allows a remote attacker to obtain AES keys via a direct request to /hwp/get.asp. Additionally, the weak encryption scheme (fixed byte reordering) enables key recovery through brute force.
A buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
Multiple SQL injection vulnerabilities in ESMI PayPal Storefront allow remote attackers to execute arbitrary SQL commands via the idpages parameter in pages.php or the id2 parameter in products1.php.
Multiple SQL injection vulnerabilities in CoolForum 0.8 and earlier allow remote attackers to execute arbitrary SQL commands via the pseudo parameter to entete.php or the login parameter to register.php.
Vulnerability in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in command line arguments.
A stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet containing a long OCTET-STRING in the Trap variable-bindings field.
PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to headlines.php or news.php. The issue also affects versions 1.12 through 1.14 for news.php.
Vulnerability in squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.
A vulnerability in Windows 2000, XP, and Server 2003 due to improper validation of memory regions for COM structured storage files allows an attacker to execute arbitrary code via a specially crafted file.
Heap-based buffer overflow in Trend Micro AntiVirus Library VSAPI before 7.510, as used in multiple Trend Micro products, allows remote attackers to execute arbitrary code via a crafted ARJ file with long header file names that modify pointers within a structure.
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the 'Input Validation Vulnerability.'
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
Buffer overflow vulnerability in Sun Java System Web Proxy Server (also known as Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors.
Unknown vulnerability in Citrix MetaFrame Conferencing Manager 3.0 allows conference members to bypass organizer restrictions to control the keyboard and mouse.
The vulnerability in mod_python version 2.7.8 and earlier allows a remote attacker to access restricted objects via a crafted URL.