CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in PEARLINGER Pearl Forums 2.4 were found in the forumsId and topicId parameters in index.php. They allow remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the pollid or previouspoll parameters.
In Zina 0.12.07 and earlier, the index.php file is vulnerable to SQL injection. Remote attackers can execute arbitrary SQL commands via the p parameter.
Multiple SQL injection vulnerabilities in VUBB alpha rc1 allow remote attackers to execute arbitrary SQL commands via the f parameter in viewforum.php, t parameter in viewtopic.php, and view parameter in usercp.php.
A heap-based buffer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted QuickTime Image File (QTIF), PICT, or JPEG format image with a long data field.
A vulnerability in login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid.
Unspecified vulnerability in the ptrace mechanism in SCO UnixWare 7.1.3 and 7.1.4 allows local users to gain privileges via unknown attack vectors.
A vulnerability in hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, allowing remote attackers to gain unauthorized privileges.
A buffer overflow vulnerability in petris before version 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.
The tuxpaint-import.sh script in Tux Paint version 0.9.14 and earlier creates temporary files insecurely, which may lead to unknown impacts and attack vectors.
Heap-based buffer overflow in the iGateway service of Computer Associates iTechnology products before version 4.0.051230. A remote attacker can execute arbitrary code by sending an HTTP request with a negative Content-Length field.
Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before version 2.0.3, used for user authentication against a PostgreSQL database, allow remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.
A stack-based buffer overflow in the call function of IBM DB2 versions 7.x and 8.1 allows remote attackers to execute arbitrary code by sending a long libname parameter. This vulnerability can lead to full server compromise.
Integer underflow in Apple QuickTime before 7.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Color Map Entry Size in a TGA image file.
Integer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a specially crafted TIFF image file with modified image height and width (ImageWidth) tags.
The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename processed by the display command.
The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Multiple SQL injection vulnerabilities in Copernicus Europa allow remote attackers to execute arbitrary SQL commands via unknown vectors. The provenance of this information is unknown; details are obtained solely from third party information.
Multiple cross-site request forgery (CSRF) vulnerabilities in YaPIG 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user, e.g., tricking an administrator into accessing a page that triggers a mod_info action in modify_gallery.php.