CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in Xpand Rally version 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
Multiple SQL injection vulnerabilities were found in Valdersoft Shopping Cart 3.0. An attacker can remotely execute arbitrary SQL commands by manipulating parameters in various PHP scripts.
SQL injection vulnerability in PHP scripts of phpMyFamily 1.4.0 allows remote attackers to execute arbitrary SQL commands via the person parameter in people.php or the Login field.
Buffer overflow in luxman before version 0.41, when used with certain insecure svgalib libraries, allows local users to execute arbitrary code via a long -f command line argument.
Buffer overflow vulnerability in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.
Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the language parameter to register.php, change email feature in profile.php, posts or topics parameter to moderate.php.
A buffer overflow vulnerability in the ipl_varyon tool on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument.
The S/MIME plugin 0.4 and 0.5 for Squirrelmail contains a vulnerability in viewcert.php that allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the cert parameter.
A format string vulnerability in the SetImageInfo function in image.c in ImageMagick before version 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to the convert utility, which may be called by other web applications.
Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code via a long packet to UDP port 41524, which is not properly handled in a recvfrom call.
A buffer overflow vulnerability in McAfee Scan Engine 4320 with DAT version prior to 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field. This is a variant of CVE-2005-0643.
A vulnerability in Firefox, Mozilla Suite, and Netscape browsers allows remote attackers to execute arbitrary code by adding a new search plugin using sidebar.addSearchEngine. The issue is fixed in Firefox 1.0.3, Mozilla Suite 1.7.7, and Netscape 7.2.
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
A vulnerability in ReviewPost PHP Pro before version 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, bypassing intended restrictions.
Format string vulnerability in the chdev tool in IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
A logic error in the CRAM-MD5 code of the UW-IMAP server, when CRAM-MD5 is enabled, does not properly enforce all required conditions for successful authentication, allowing remote attackers to authenticate as arbitrary users.
A buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
Samsung ADSL Modem SMDK8947v1.2 uses default passwords for the root, admin, and user accounts, allowing remote attackers to gain privileges via Telnet or an HTTP request to adsl.cgi.
Unknown vulnerability in Webmin and Usermin before version 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
Vulnerability in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in command line arguments.