CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allow remote attackers to execute arbitrary code via a long file parameter after a percent sign in an HTTP GET request or a long Lock-Token string in WebDAV functionality.
The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
The include.cgi script allows remote attackers to read arbitrary files by providing a full pathname in the argument.
The inserter.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
The include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
PHP remote file inclusion vulnerability in Yappa-NG before version 2.3.2 allows remote attackers to execute arbitrary PHP code via unknown vectors.
A vulnerability in the Affix Bluetooth Protocol Stack for Linux allows local users to gain privileges via a socket call with a negative protocol value, which is used as an array index.
The citat.pl script allows remote attackers to read arbitrary files via a full pathname in the argument.
Format string vulnerability in the snmppd_log function in snmppd_util.c for snmppd 0.4.5 and earlier may allow remote attackers to cause a denial of service or execute arbitrary code via format string specifiers that are not properly handled in a syslog call.
Multiple SQL injection vulnerabilities in BK Forum 4.0 allow remote attackers to execute arbitrary SQL commands via the id parameter in member.asp, forum parameter in forum.asp, and various parameters in register.asp.
SQL injection vulnerability in bBlog 0.7.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Multiple SQL injection vulnerabilities in CartWIZ ASP Cart allow remote attackers to execute arbitrary SQL commands via the idProduct parameter in addToCart.asp and productDetails.asp, priceFrom, idCategory, priceTo in searchResults.asp, and idParentCategory in productCatalogSubCats.asp.
Multiple directory traversal vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote authenticated users to read arbitrary files via the UIDL parameter to the msg script or copy/move the user's .eml file to arbitrary locations via the delete script.
Kommander in KDE 3.2 through KDE 3.4.0 executes data files without user confirmation, allowing remote attackers to execute arbitrary code.
Directory traversal vulnerability in the third party tool from NetIQ, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via '..' sequences in a GET request. The vendor has disputed this issue, stating that neither NetIQ Security Manager nor their iSeries Security Solutions are vulnerable.
Directory traversal vulnerability in the third party tool from Castlehill, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request.
Directory traversal vulnerability in the Powertech tool used to secure the iSeries AS/400 FTP server allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request.
McAfee Internet Security Suite 2005 uses insecure default ACLs for installed files, which allows local users to gain privileges or disable protection by modifying certain files.
The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag.
Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code.