CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities were found in ASPPortal 3.00. Their exact impact and attack vectors are unknown.
SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter.
The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 is vulnerable to a remote attack that can cause denial of service and possibly arbitrary code execution via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite.
SQL injection vulnerability in index.php of OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.
In Microsoft Commerce Server 2002 before SP2, sample files in the authfiles directory allow authentication bypass. An attacker can log in to authfiles/login.asp with a valid username and any password, then navigate to the main site twice to gain access without proper authorization.
SQL injection vulnerability in Maian Support 1.0 allows remote attackers to execute arbitrary SQL commands via the email or pass parameter in admin/index.php.
An Eval Injection vulnerability in cal.php of Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary PHP code via the 'date' parameter to index.php.
A stack-based buffer overflow in the IMAP service of Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by sending a long string to the LOGIN or SELECT commands.
Unspecified vulnerability in the Webmail module in Winmail before version 4.3. It may have unknown impact and unknown remote attack vectors.
An unspecified vulnerability in BorderWare MXtreme 5.0 and 6.0 allows remote attackers to have an unknown impact via unknown attack vectors. The details are obtained solely from third party information.
In glFTPd before version 2.01 RC5, an unspecified vulnerability allows remote attackers to bypass IP checks via a crafted DNS hostname that may appear to be an IP address.
An unspecified vulnerability in the mklvcopy tool within the BOS.RTE.LVM component of IBM AIX 5.3 allows local users to execute arbitrary commands. The issue is likely due to an untrusted search path vulnerability when mklvcopy calls external commands.
A buffer overflow vulnerability exists in mshtml.dll of Microsoft Internet Explorer 6.0.2900.2180 (and likely other versions). A remote attacker can exploit an HTML tag with a large number of event handlers (e.g., onclick, onload, onmouseover), causing memory corruption and arbitrary code execution.
An unspecified vulnerability in certain versions of xpdf after 3.00, used in various products including pdfkit.framework, gpdf, pdftohtml, and libextractor, has unknown impact and requires user interaction. The vulnerability may involve errors in gmem.c, SplashXPathScanner.cc, JBIG2Stream.cc, JPXStream.cc, or Stream.cc.
In Simple PHP Blog (SPB) 0.4.7.1 and earlier, the install05.php file contains a directory traversal vulnerability. An attacker can remotely include and execute arbitrary local files by using directory traversal sequences and a NUL (%00) character in the blog_language parameter, allowing injection of PHP code into the Apache access_log file and its execution.
DSNewsletter 1.0 has multiple SQL injection vulnerabilities in the email parameter in include/sub.php, include/confirm.php, and include/unconfirm.php. An attacker can remotely execute arbitrary SQL commands if magic_quotes_gpc is disabled.
A buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command. This is a different vulnerability than CVE-2006-1010.
In DSDownload 1.0, with magic_quotes_gpc disabled, the 'key' and 'category' parameters in search.php and downloads.php are vulnerable to SQL injection. This allows remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in search.asp in Hosting Controller 6.1 (Hotfix 2.9) allows remote attackers to execute arbitrary SQL commands via the search parameter. The details are obtained solely from third party information.
An unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 through 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. Due to the lack of specific information in the vendor advisory, it is unclear how this vulnerability differs from CVE-2006-0397 and CVE-2006-0398.