CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In versions 1.6.10 to 1.6.15 of the Eggheads Eggdrop IRC bot, the Share.mod component may mistakenly assign STAT_OFFERED status to a bot that is not a sharebot. This allows remote attackers to use this status to promote a bot to a sharebot and conduct unauthorized activities.
Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
Multiple buffer overflows in Overkill (0verkill) version 0.15pre3 may allow local users to execute arbitrary code in the client via a long HOME environment variable in the load_cfg and save_cfg functions. It may also allow remote attackers to execute arbitrary code via long strings to the send_message function and, in the server, via the parse_command_line function.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
The firmware of the Gigabyte Gn-B46B 2.4Ghz wireless broadband router version 1.003.00 allows local users on the same network to bypass authentication by using a copy of the router's HTML menu on a separate system.
Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
The American Power Conversion (APC) Web/SNMP Management SmartSlot Card versions 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access.
A stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before version 4.5.538.001 and ZoneLabs Integrity client before version 4.0.146.046 and 4.5 before version 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 version 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.
Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.
Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username.
Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.
SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages.