CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a specially crafted playlist (.pls) file with an overly long filename in the File1 field.
A heap-based buffer overflow in Splash.cc in xpdf, also used in poppler, kdegraphics, gpdf, and pdfkit.framework, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that exceed the width or height of the associated bitmap.
CommuniGate Pro Core Server before version 5.0.7 is vulnerable to a remote denial of service (crash) and potential arbitrary code execution via crafted LDAP messages with negative BER lengths.
IdeoContent Manager contains SQL injection vulnerabilities in index.php. Remote attackers can execute arbitrary SQL commands via the goto_id or mid parameters.
SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.
A vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via crafted HTML. This can expose the browser to attacks that would otherwise be prevented by the Kill bit setting.
Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username in SMTP AUTH PLAIN or AUTH LOGIN commands, a long username in the POP3 APOP command, or a long IMAP DELETE command.
Multiple directory traversal vulnerabilities exist in the IMAP service of E-Post Mail 4.05 and SPA-PRO Mail 4.05. Attackers can use LIST, APPEND, COPY, or RENAME commands to list arbitrary directories, create files, or cause a denial of service.
A stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.
An unspecified vulnerability in Oracle PL/SQL (PLSQL) allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures. This affects multiple versions of Database Server, Application Server, E-Business Suite, and Collaboration Suite.
An unspecified vulnerability in HP-UX versions B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.
An unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.
BEA WebLogic Portal 8.1 through SP3 stores the RDBMS Authentication provider password in cleartext in the config.xml file, allowing attackers to escalate privileges.
In BEA WebLogic Server and WebLogic Express versions 8.1 through SP4, when configuration auditing is enabled and a password change occurs, old and new passwords are stored in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.
Multiple SQL injection vulnerabilities were found in index.php in NewsPHP. Remote attackers can execute arbitrary SQL commands via the discuss, tim, id, last, and limit parameters.
Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), allowing remote attackers to hijack sessions and potentially gain administrative privileges.
Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.
SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.
A vulnerability in the rsh utility in Sun Grid Engine (SGE) before version 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.