CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05 (and possibly 5.06) allows remote attackers to execute arbitrary code via a crafted .m3u playlist file.
The init scripts in Search for Extraterrestrial Intelligence (SETI) project 3.08-r3 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.
Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code via a long Overwrite header.
Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in title or baseurl fields.
Vulnerability in the Archive::Zip Perl module before version 1.14, used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
Buffer overflow vulnerability in hpsockd before version 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.
The binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 improperly handles a failed call to the mmap function, resulting in an incorrect mapped image. A local user can exploit this vulnerability to execute arbitrary code.
Buffer overflow in the process_font_table function in convert.c for unrtf 0.19.3 allows remote attackers to execute arbitrary code via a crafted RTF file.
phpMyAdmin versions 2.6.0-pl2 and earlier before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.
Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before version 2.84 allow remote attackers to execute arbitrary SQL commands via the cat parameter in showcat.php and the product parameter in addfav.php.
A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to remain in IIS or Exchange mail queues.
A vulnerability in FlatNuke 2.5.1 allows a remote attacker to inject and execute arbitrary PHP code by placing it in the url_avatar field.
SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.
Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
A buffer overflow in the POP3 server of 1st Class Mail Server 4.0 via an APOP USER command with a long second parameter (digest) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before version 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unknown vulnerability in Tutti Nova versions 0.10 through 0.12 (Beta) and 0.9.4, when register_globals is enabled, has unknown impact and attack vectors.
Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the sortBy, sortOrder, startReg, U, LastCheck, and R parameters.
The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.