CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco Wireless LAN Solution Engine (WLSE) versions 2.0 through 2.5 and Hosting Solution Engine (HSE) versions 1.7 through 1.7.3 have a hardcoded username and password. This allows remote attackers to add new users, modify existing users, and change configuration.
Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query.
The Virtual DOS Machine (VDM) subsystem component in Windows NT 4.0 and Windows 2000 does not properly validate system structures, allowing local users to access protected kernel memory and execute arbitrary code.
An unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code.
There is a stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of Microsoft Windows, allowing remote attackers to execute arbitrary code.
A stack-based buffer overflow in the Socks-5 proxy code for XChat versions 1.8.0 to 2.0.8 allows remote attackers to execute arbitrary code when socks5 traversal is enabled.
Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, used in various versions of Windows, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.
A double free vulnerability in the ASN.1 library used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
The vulnerability in PHP-Nuke 7.3 and related systems (Nuke Cops betaNC, OSCNukeLite 3.1, OSC2Nuke 7x) results from improper use of the eregi() function with $_SERVER['PHP_SELF'] to identify the calling script. This allows a remote attacker to directly access scripts, obtain path information via a PHP error message, and potentially gain access, for example through an HTTP request containing the string "admin.php".
A remote file inclusion vulnerability in secure_img_render.php of e107 0.615 allows attackers to execute arbitrary PHP code by modifying the 'p' parameter to reference a URL on a remote server containing malicious code.
Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php, (2) content_id parameter to content.php, or (3) list parameter to news.php.
SQL injection vulnerability in the art_print function in print.inc.php in unknown versions of jPortal before 2.3.1 allows remote attackers to inject arbitrary SQL commands via the id parameter.
The vulnerability in Netgear RP114 allows a remote attacker to bypass keyword-based URL filtering by requesting a long URL, for example containing a large number of %20 (hex-encoded space) sequences.
In SUSE LINUX 9.1 Personal edition Live CD, the root account is configured without a password, allowing remote attackers to gain privileges via SSH.
In DeleGate version 8.9.2 and earlier, the ssl_prcert function in the SSLway filter (sslway.c) contains a buffer overflow. A remote attacker can exploit a certificate with a long subject or issuer name field to execute arbitrary code.
The Downloads module in Php-Nuke 6.x through 7.2 contains an SQL injection vulnerability. A remote attacker can execute arbitrary SQL queries via the orderby or sid parameters in modules.php.
The dissect_attribute_value_pairs function in packet-radius.c for Ethereal versions 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
Unknown vulnerability in ecartis before version 1.0.0 does not properly validate user input, allowing attackers to obtain mailing list passwords.
Apache versions 1.4.x before 1.3.30 and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allow remote attackers to cause a denial of service (blocked new connections) via a 'short-lived connection on a rarely-accessed listening socket.'
Multiple buffer overflows in vfte, based on FTE, before version 0.50, allow local users to execute arbitrary code.