CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property followed by a long string.
A buffer overflow vulnerability in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag.
SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to inject SQL code via the catcode parameter, potentially leading to unauthorized access and privilege escalation.
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter in the recentTopics and welcome functions.
SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the username and password parameters.
In Novell Web Manager for Novell NetWare 6.5, the webadmin-apache.conf file uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, allowing remote attackers to bypass access control to the WEB-INF folder.
Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to avatar retrieval.
SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.
Multiple buffer overflows in Gyach Enhanced (Gyach-E) before version 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by sending certain typing statuses or setting the chat room status bar to the current chat room name.
A stack-based buffer overflow vulnerability in the FTP daemon of HP-UX 11.11i with the -v (debug) option enabled allows remote attackers to execute arbitrary code via a long command request.
Vulnerability in the exec_dir PHP patch (php-exec-dir) versions 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.
Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.
An unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. The provenance of this information is unknown; details are obtained from third party reports.
The vulnerability in distcc 2.x, used in XCode 1.5 and others, allows remote attackers to execute arbitrary commands by sending compilation jobs, which are executed without authorization checks when the server is not configured to restrict access to the port.
Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted mount or sysfs system calls.
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.
Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the clientRcptTo array, and the Received and messageID variables, possibly involving HELO and hostname arguments.
The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before version 2.0 does not drop privileges when using the help functionality, allowing local users to gain privileges.
The vulnerability in Java 2 Micro Edition (J2ME) stems from improper bytecode validation, allowing a remote attacker to escape the Kilobyte Virtual Machine (KVM) sandbox and execute arbitrary code.
SQL injection vulnerability in Interchange before version 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.