CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In DSChat 1.0, the Nickname field is not sanitized before creating a file in a user directory, allowing a remote attacker to execute arbitrary PHP code. The vulnerability was reported by a third party and details are unknown.
In RWiki versions 2.1.0pre1 through 2.1.0, the editing form contains a vulnerability allowing remote execution of arbitrary Ruby code. Attackers can exploit unknown attack vectors to take control of the server.
The snmp_trap_decode function in the SNMP NAT helper in Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that trigger failures in snmp_trap_decode, leading to frees of random memory or double-free by snmp_trap_decode and its calling function, as demonstrated by certain test cases of the PROTOS SNMP test suite.
SQL injection vulnerability in links.php of 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board. Remote attackers can execute arbitrary SQL commands via the cat parameter.
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS["CLPath"] parameter to reconfig.php and srxclr.php. This may be due to a globals overwrite issue.
Multiple unspecified vulnerabilities in Software Distributor on HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allow local users to gain privileges via unspecified attack vectors.
An unspecified vulnerability in HP OpenView Storage Data Protector 5.1 and 5.5 allows remote attackers to execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in HP OpenView Network Node Manager (OV NNM) versions 6.20, 6.4x, 7.01, and 7.50 allow remote attackers to gain privileged access, execute arbitrary commands, or create arbitrary files via unknown vectors.
A stack-based buffer overflow in PDF Form Filling and Flattening Tool before version 3.1.0.12 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long field names.
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the author_id parameter in profile.php and the aut_id parameter in userarticles.php. Invalid SQL manipulation via the aut_id vector may also result in path disclosure.
A vulnerability in PostgreSQL allows attackers to bypass SQL injection protections by using invalid encodings of multibyte characters. Affected versions include 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier.
PostgreSQL vulnerability allows bypassing SQL injection protection in applications using multibyte encodings (SJIS, BIG5, GBK, GB18030, UHC). The issue stems from improper handling of the 0x5c (backslash) byte as the trailing byte of a multibyte character by clients that do not support these encodings.
In Sitecom WL-153 router firmware before version 1.38, a vulnerability exists due to missing validation of the InternalClient parameter in UPnP requests. A remote attacker can bypass access restrictions and perform unauthorized operations, such as forwarding arbitrary traffic via AddPortMapping.
The Linksys WRT54G Wireless-G Broadband Router has a vulnerability in UPnP handling that allows remote attackers to bypass access restrictions and perform unauthorized operations by sending a UPnP request with a modified InternalClient parameter, which is not validated. This is demonstrated by using AddPortMapping to forward arbitrary traffic.
ZyXEL P-335WT router does not validate the InternalClient parameter in UPnP requests, allowing remote attackers to bypass access restrictions and perform unauthorized operations, such as adding port mappings (AddPortMapping) for arbitrary traffic.
The Edimax BR-6104K router has a vulnerability in UPnP handling that allows remote attackers to bypass access restrictions and perform unauthorized operations. By modifying the InternalClient parameter in a UPnP request, an attacker can add port forwarding rules (AddPortMapping) and redirect arbitrary network traffic.
A vulnerability in Prodder and perlpodder before version 0.5 allows remote attackers to execute arbitrary code by injecting shell metacharacters into the podcast URL (url attribute of an enclosure tag or $enc_url variable). When wget is run, the metacharacters are interpreted by the shell, leading to command execution.
Multiple integer overflows in FreeType before version 2.2 were found in bdf/bdflib.c, sfnt/ttcmap.c, cff/cffgload.c, and the read_lwfn function when processing LWFN files. This vulnerability allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code.
SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter in login.asp and main.asp.
Unspecified vulnerability in the sapdba command in SAP with Informix before version 700 and in version 700 up to patch 100 allows local users to execute arbitrary commands via insecure environment variable handling.