CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in the DVD subpicture decoder of xine-lib 1-rc5 and earlier allows remote attackers to execute arbitrary code via a specially crafted DVD or MPEG subpicture header where the second field reuses RLE data from the end of the first field.
Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via malformed (1) AVI, (2) BMP, or (3) DIB files.
SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting from the same IP address as the logged-in administrator, then accessing setup_status.htm or status.HTM pages.
The vulnerability in McAfee VirusScan 4.5.1 is that the application does not drop SYSTEM privileges before allowing users to browse for files via the System Scan properties of the System Tray applet, which could allow local users to gain privileges.
Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a crafted GG_MSG_IMAGE_REPLY message.
Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the pageid, subid, or catid parameters.
Multiple directory traversal vulnerabilities in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to create arbitrary directories via the 'user' parameter in viewaction.html or rename arbitrary files via the 'folderold' or 'folder' parameters in folders.html.
Buffer overflow vulnerability in the Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8, 10.3.4, and 10.3.5. A local user can exploit this flaw to execute arbitrary code by setting a specific environment variable.
Vulnerability in OpenLDAP versions 1.0 through 2.1.19, used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, allows hashed (crypt) passwords in the userPassword attribute to be used as if they were plaintext passwords. This enables remote attackers to reuse hashed passwords without decrypting them.
A vulnerability in MailWorks Professional allows remote attackers to bypass authentication and gain elevated privileges by setting a cookie containing 'auth=1' and 'uId=1'.
SQL injection vulnerability in the calendar module of phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via the cal_template parameter.
Multiple stack-based buffer overflows in IBM DB2 7.x and 8.1 allow local users to execute arbitrary code via a long third argument to the rec2xml function or a long filename argument to the generate_distfile procedure.
The D-Link DCS-900 Internet Camera listens on UDP port 62976 for an IP address, which allows remote attackers to change the IP address of the camera via a UDP broadcast packet.
A buffer overflow vulnerability in Microsoft Msinfo32.exe might allow local users to execute arbitrary code via a long filename in the msinfo_file command line parameter. Note that this issue might not cross security boundaries and may be rejected in the future.
Buffer overflow vulnerability in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2. A local user can exploit a long LAYER parameter to execute arbitrary code.
phpScheduleIt 1.0.0 RC1 does not clear administrative privileges if the administrator logs in as a normal user, which allows users with physical access to gain administrative privileges.
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to show_archives.php or show_news.php.
SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.
Multiple buffer overflows in QNX Photon microGUI for QNX RTP 6.1 in tools phrelay-cfg, phlocale, pkg-installer, and input-cfg allow local users to gain privileges via a long -s (server) command line parameter.
Stack-based buffer overflow in Gaucho 1.4 Build 145 allows remote attackers to execute arbitrary code via a POP3 email with a long Content-Type header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS