CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Servers Alive versions 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading the local manual from the help menu. This allows local users to escalate their privileges.
PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to modify the 'page' parameter to execute arbitrary PHP code (version 2.0) or include local files (version 2.5 beta 10 and earlier).
Novell iChain Mini FTP Server 2.3 and earlier versions do not limit the number of incorrect login attempts, making it easier for remote attackers to perform brute force login attacks.
SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter in index.php or the page parameter in zpanel.php.
An unknown vulnerability in Information Resource Manager (IRM) before version 1.5.2.1 allows remote attackers to have a potentially serious impact, related to LDAP logins.
SQL injection vulnerability in gb_new.inc in SimpGB allows remote attackers to execute arbitrary SQL commands via the quote parameter to guestbook.php.
PHP remote file inclusion vulnerability in initdb.php for WEBInsta Mailing list manager 1.3d allows remote attackers to execute arbitrary PHP code by modifying the absolute_path parameter to reference a URL on a remote web server that contains the code.
SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter.
SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the articleid parameter to article.php.
Multiple buffer overflows in the dissect_a11_radius function in the CDMA A11 (3G-A11) dissector (packet-3g-a11.c) for Ethereal 0.10.9 and earlier allow remote attackers to execute arbitrary code via RADIUS authentication packets with large length values.
Buffer overflow in ArGoSoft FTP Server 1.4.2.8 allows remote authenticated users to execute arbitrary code via a long DELE command. This issue was later reported to also affect version 1.4.3.5.
Multiple access validation errors in OutStart Participate Enterprise (PE) allow remote attackers to browse arbitrary directory trees, rename and delete directory objects, and conduct other unauthorized activities by manipulating HTTP request parameters.
PHP remote file inclusion vulnerability in admin/header.php of PHP mcNews 1.3 allows remote attackers to execute arbitrary PHP code by modifying the skinfile parameter to reference a URL on a remote web server that contains the code.
A vulnerability in the includer.cgi script of The Includer allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the URL or template parameter.
PHP remote file inclusion vulnerability in download_center_lite.inc.php for Download Center Lite 1.6 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code.
In mlterm versions 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, an integer overflow exists. A remote attacker can exploit a large image file used as a background to execute arbitrary code.
A buffer overflow vulnerability in JoWood Chaser version 1.50 and earlier allows remote attackers to cause a denial of service (client or server crash) and execute arbitrary code via a long nickname.
SQL injection vulnerability in the process_picture function in xp_publish.php in CopperExport 0.2.1 allows remote attackers to execute arbitrary SQL commands, possibly via the title, caption, or keywords parameters.
In the Linux kernel before version 2.6.8.1, the file nls_ascii.c uses an incorrect table size, allowing attackers to cause a buffer overflow and trigger a denial of service (kernel crash).
Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address, which is not properly handled when printing the header.