CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.
A vulnerability in Apple Safari 2.0.2 allows remote attackers to cause a system slowdown via a JavaScript BODY onload event that calls the window function.
A vulnerability in Gadu-Gadu 7.20 allows a remote attacker to cause a denial of service (DoS) by sending multiple DCC packets with code 6 or 7. This triggers a large number of popup windows and creates an excessive number of threads, leading to system overload.
A stack-based buffer overflow in Gadu-Gadu 7.20 occurs when processing an image filename between 192 and 200 characters, as the "imgcache\" string appended to the buffer is not accounted for, allowing remote attackers to cause a denial of service (crash).
An unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to an unchecked buffer and possible buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image.
Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
A vulnerability in Mozilla browser allows a remote attacker to cause a denial of service (DoS) via excessive CPU consumption. The attack exploits a JavaScript BODY onload event that calls the window function.
A memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service by sending multiple DCC packets with a code other than 2 and a large size field, which allocates memory for the packet but does not free it after the packet has been dropped.
A vulnerability in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and configuration loss) via a page with a large number of gg: URIs.
Unspecified vulnerability in Cisco Security Agent (CSA) 4.5.0 and 4.5.1 agents, when running on Windows systems, allows local users to bypass protections and gain system privileges by executing certain local software.
Multiple SQL injection vulnerabilities in adcbrowres.php in AD Center ADC2000 NG Pro 1.2 and NG Pro Lite allow remote attackers to execute arbitrary SQL commands via the cat and lang parameters.
Multiple SQL injection vulnerabilities in Omnistar KBase 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in users/comments.php, (2) category_id and (3) id parameters in users/kb.php.
In edmoBBS 0.9 and earlier, multiple SQL injection vulnerabilities exist in edmobbs9r.php. Remote attackers can execute arbitrary SQL commands via the 'table' and 'messageID' parameters.
SQL injection vulnerability in index.php in SourceWell 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the cnt parameter. Some reports indicate the affected version is 1.1.3, but as of November 29, 2005, the most recent version appears to be 1.1.2.
Multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier allow remote attackers to execute arbitrary SQL commands via the FORUM_ID parameter in forum.php, and the TOPIC_ID, FORUM_ID, and CAT_ID parameters in topic.php.
SQL injection vulnerability in answer.php in FAQSystems FAQRing Knowledge Base Software 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
In Zainu 2.0 and earlier, multiple SQL injection vulnerabilities exist in the search action. A remote attacker can execute arbitrary SQL commands via the 'term' and 'start' parameters in index.php.
A PHP remote file inclusion vulnerability in athena.php of Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.
Buffer overflow vulnerability in unalz before version 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS