CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
The firmware of the Gigabyte Gn-B46B 2.4Ghz wireless broadband router version 1.003.00 allows local users on the same network to bypass authentication by using a copy of the router's HTML menu on a separate system.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
Buffer overflow vulnerability in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including version 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.
Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed (.RP, .RT, .RAM, .RPM, .SMIL) files.
SQL injection vulnerability in login.asp in thePHOTOtool allows remote attackers to gain unauthorized access via the password field.
Multiple buffer overflows in Overkill (0verkill) version 0.15pre3 may allow local users to execute arbitrary code in the client via a long HOME environment variable in the load_cfg and save_cfg functions. It may also allow remote attackers to execute arbitrary code via long strings to the send_message function and, in the server, via the parse_command_line function.
SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain unauthorized access via the photo variable.
Multiple PHP remote file inclusion vulnerabilities in Les Commentaires 2.0 allow remote attackers to execute arbitrary PHP code via the rep parameter.
SQL injection vulnerability in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain privileges via the product parameter in showproduct.php or the cat parameter in showcat.php.
IBM Cloudscape 5.1 running on jdk 1.4.2_03 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL code, possibly due to a SQL injection vulnerability.
In OpenJournal versions 2.0 through 2.0.5, the oj.cgi script allows remote attackers to bypass authentication and access the control panel by setting the uid parameter to 0.
SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages.
Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.
The vulnerability in viewtopic.php of phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
The vulnerability in Sophos Small Business Suite 1.00 on Windows involves improper handling of files whose names contain reserved MS-DOS device names such as LPT1, COM1, AUX, CON, or PRN. This allows malicious code to bypass detection when installed, copied, or executed.
Integer overflow vulnerability in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition. A remote attacker can exploit improper length validation in compressed (zipped) folders to execute arbitrary code.