CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.
The awp_log function in apt-www-proxy 0.1 has a format string vulnerability that allows remote attackers to execute arbitrary code.
Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.
Netgear FM114P firmware version 1.3 allows remote attackers to cause a denial of service (crash or hang) by sending a large number of TCP connection requests.
VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges.
f2html.pl versions 0.1 through 0.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via file names.
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
The SURECOM EP-4501 broadband router uses a default SNMP read community string of 'public' and a default SNMP read/write community string of 'secret,' allowing remote attackers to read and modify router configuration information.
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
Virgil CGI Scanner version 0.9 allows remote attackers to execute arbitrary commands via the tar (TARGET) or zielport (ZIELPORT) parameters.
Multiple buffer overflows in Gringotts 0.5.9 allow local users to execute arbitrary commands via unknown attack vectors.
The Click2Learn Ingenium Learning Management System versions 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), allowing attackers to obtain passwords.
AstroCam versions 0.9-1-1 through 1.4.0 allow remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request.
acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2.
NewsPro version 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to 'logged,true'.
The user_profile.asp file in PortalApp version 2.2 allows local users to gain elevated privileges by modifying the user_id variable.
Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
MyPHPLinks versions 2.1.9 and 2.2.0 have an SQL injection vulnerability in admin/auth/checksession.php that allows remote attackers to execute arbitrary SQL commands via the idsession parameter.
KaZaA Media Desktop version 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages.
VelociRaptor 1.0 has a memory leak in the httpd, nntpd, and VPN driver components, allowing remote attackers to cause a denial of service through memory consumption.