CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the ibProArcade module for Invision Power Board (IPB) versions 1.x and 2.x. Remote attackers can execute arbitrary SQL commands via the 'cat' parameter in index.php.
PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_path parameter to reference a URL on a remote web server that contains the code.
Unknown vulnerability in Moodle before version 1.2, related to improper text filtering. The impact and attack vectors are unknown.
Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred.
Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file, then extracting the username, password, and other data from the file.
SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in an HTTP request.
Unknown front page vulnerability with Moodle servers before version 1.3.2, with unknown impact and attack vectors.
A vulnerability in Novell Client Firewall (NCF) 2.0, based on Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with elevated privileges.
A buffer overflow vulnerability in pop3.c in gnubiff before version 2.0.0 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.
SQL injection vulnerability in post.php in Invision Power Board (IPB) versions 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.
SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the eid or cid parameters.
The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default login text for the management interface, which allows remote attackers to gain access.
Vulnerability in Hired Team: Trial 2.0 and earlier and version 2.200 allows game players to kick other players off the server, including the administrator, without any restrictions.
SQL injection vulnerability in sql.php of the Glossary module in Moodle 1.4.1 and earlier allows remote attackers to modify SQL statements.
An unspecified vulnerability in Hitachi Web Page Generator and Web Page Generator Enterprise version 4.01 and earlier allows remote attackers to cause a denial of service (DoS) via unknown attack vectors when a web site is improperly accessed.
Unspecified vulnerability in MadBMS before version 1.1.5, related to logins, has unknown impact and attack vectors.
Unspecified vulnerability in Jetty HTTP Server, as used in IBM Trading Partner Interchange before 4.2.4 and CA Unicenter Web Services Distributed Management (WSDM) before 3.11, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via the bug_id parameter (viewvotes operation) or the project parameter (add operation).
Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long SRC or NAME attributes in IFRAME, FRAME, and EMBED elements, originally discovered using the mangleme utility, also known as 'the IFRAME vulnerability' or 'HTML Elements Vulnerability'.
Buffer overflow vulnerability in the LDAP component of Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems. A remote attacker can exploit this flaw to execute arbitrary code.