CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple format string vulnerabilities in OpenBOR 2.0046 and earlier, Beats of Rage (BOR) 1.0029 and earlier, and Horizontal Shooter BOR (HOR) 2.0000 and earlier allow remote code execution via format string specifiers in mod configuration files, such as the music identifier in data/scenes/intro.txt and background identifier in data/easy/1aeasy.txt, which are improperly handled in the update and shutdown functions.
A vulnerability in Ipswitch WhatsUp Professional 2006 allows a remote attacker to impersonate a trusted console by manipulating HTTP headers. User identity verification relies solely on headers, enabling authentication bypass.
Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, allowing remote attackers to gain privileges.
SQL injection vulnerability in MyWeb Portal Office allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. The issue affects all editions: Standard, Public, Medical, Citizen, School, and Light.
PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
A vulnerability in Coppermine before version 1.4.6 allows remote attackers to upload arbitrary files via a filename with multiple file extensions when Apache has mod_mime installed.
A vulnerability in phpBazar 2.1.0 and earlier allows remote attackers to bypass authentication and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1 in admin/admin.php.
A PHP remote file inclusion vulnerability in config.php of phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.
An unspecified vulnerability in the installation process of Sun Java System Directory Server 5.2 causes incorrect user data to be written to a file created during installation, allowing remote or local attackers to gain elevated privileges.
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
SQL injection vulnerability in the Short Url & Url Tracker Script by YourFreeWorld.com allows remote attackers to execute arbitrary SQL commands via the id parameter in login.php.
Multiple SQL injection vulnerabilities in mono AZBOARD 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the search and cate parameters in list.asp and the id and cate parameters in admin_ok.asp.
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in index.php, song.php, faq.php, list.php, gen_m3u.php, and playlist.php.
A buffer overflow vulnerability in the SCTP implementation in the Linux kernel before version 2.6.16.17 allows a remote attacker to cause a system crash (denial of service) and potentially execute arbitrary code by sending a crafted HB-ACK chunk.
A vulnerability in the SCTP implementation in the Linux kernel before version 2.6.16.17 allows a remote attacker to cause a system crash (denial of service) and potentially execute arbitrary code by sending a packet with a chunk length inconsistent with the actual length of provided parameters.
A CSRF vulnerability in Serendipity before version 1.0-beta3 allows remote attackers to perform unauthorized actions on behalf of a logged-in user via a crafted link or IMG tag.
A buffer overflow in iMonitor 2.4 in Novell eDirectory 8.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown attack vectors.
SQL injection vulnerability in default.asp of CodeAvalanche News (CANews) 1.2. Allows remote attackers to execute arbitrary SQL commands via the password field.
A buffer overflow vulnerability exists in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, and Microsoft Works Suites through 2006. This allows user-assisted attackers to execute arbitrary code via a malformed object pointer.
In Linux kernels 2.6.16 and earlier, the readv and writev functions lack the appropriate LSM (Linux Security Modules) file_permission hooks, potentially allowing bypass of intended access restrictions.