CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Journalness 3.0.7 and earlier allows remote attackers to create or modify posts via unknown attack vectors.
Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace Server, Service Provider Offering for Multi-platforms 2.1.3 to 2.15 allows remote attackers to hijack sessions of authenticated users via unknown attack vectors involving certain cookies, aka 'Potential Credential Impersonation Attack.'
A buffer overflow vulnerability in the strip_html_tags method in Gyach Enhanced (Gyach-E) before version 1.0.4 allows remote attackers to cause a denial of service and potentially execute arbitrary code via unknown vectors involving HTML tags.
Buffer overflow in queue.c and queued.c in queue before version 1.30.1 may allow remote attackers to execute arbitrary code.
The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.
SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before version 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unspecified vulnerability in ASN.1 Compiler (asn1c) before version 0.9.7, occurring when processing "ANY" type tags.
SQL injection vulnerability in DUware DUforum versions 3.0 through 3.1. Allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, MSG_ID parameter in messageDetail.asp, or password parameter in the login form.
SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Unknown vulnerability in Moodle before version 1.2 allows teachers to log in as administrators.
A buffer overflow vulnerability in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.
Multiple buffer overflows in ArGoSoft FTP Server before version 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument, or (2) a SITE COPY with a long argument.
A vulnerability in the Windows Internet Naming Service (WINS) allows a remote attacker to execute arbitrary code or cause a denial of service (server crash) by sending a specially crafted WINS packet with an improperly validated computer name. The issue results from an unchecked buffer, potentially leading to a buffer overflow.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including (1) s, w, and d in users.php, (2) id in comments.php, (3) rusername in auth.php, or (4) h in plug.php.
A stack-based buffer overflow in the site chmod command in Serv-U FTP Server before version 4.2 allows remote attackers to execute arbitrary code via a long filename.
Vulnerability in Online-bookmarks before version 0.4.6 allows remote attackers to bypass the authentication mechanism via direct requests to configuration files or PHP scripts such as config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php.
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
Unknown vulnerability in the dotlock implementation in mailutils before version 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges.
SQL injection vulnerability in the sloth TCL script in QuoteEngine before version 1.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Vulnerability in JSSE 1.0.3 through 1.0.3_2 causes improper validation of the client or server certificate chain, allowing a remote attacker to falsely authenticate peers for SSL/TLS.