CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request.
Vulnerability in JSSE 1.0.3 through 1.0.3_2 causes improper validation of the client or server certificate chain, allowing a remote attacker to falsely authenticate peers for SSL/TLS.
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
Vulnerability in Online-bookmarks before version 0.4.6 allows remote attackers to bypass the authentication mechanism via direct requests to configuration files or PHP scripts such as config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php.
A stack-based buffer overflow in the site chmod command in Serv-U FTP Server before version 4.2 allows remote attackers to execute arbitrary code via a long filename.
A buffer overflow vulnerability in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.
Unknown vulnerability in Moodle before version 1.2 allows teachers to log in as administrators.
SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.
Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the img, cat, sort_key, order_key, user, or album parameters.
CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline (%0a) before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.
The set_time_limit function in Gallery before version 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute arbitrary scripts before they are deleted, if the temporary directory is under the web root.
Cisco Secure Access Control Server (ACS) version 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password.
DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filename.
The Transaction Language 1 (TL1) login interface in Cisco ONS 15327 versions 4.6(0) and 4.6(1) and 15454 and 15454 SDH versions 4.6(0) and 4.6(1) allows remote attackers to gain unauthorized access. The vulnerability occurs when a user account is configured with a blank password and the attacker logs in with a password longer than 10 characters.
SQL injection vulnerability in ttlast.php and last10.php scripts in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php.
Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitrary code.
The addImage method in admin.class.php of Image Gallery Web Application 0.9.10 does not properly validate filenames, allowing remote attackers to upload and execute arbitrary files.
PHP remote file inclusion vulnerability in index.php of GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 'doc' parameter to reference a URL on a remote web server containing the code.
Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to execute arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp, or (4) txtUserEmail parameter to forgot.asp.