CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the call function of IBM DB2 versions 7.x and 8.1 allows remote attackers to execute arbitrary code by sending a long libname parameter. This vulnerability can lead to full server compromise.
A direct static code injection vulnerability in YaPIG 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php, which inserts the code into guid_info.php. A separate CSRF vulnerability makes exploitation easier.
SQL injection vulnerability in search.php of Free ClickBank 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the keywords parameter.
A vulnerability in the Xpdf library, used in many products (e.g., gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor), allows an attacker to cause an infinite loop (denial of service) by providing streams that end prematurely, such as CCITTFaxDecode or DCTDecode. This issue is known as 'Infinite CPU spins'.
A heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via words longer than the input buffer used by flex.
PHP remote file inclusion vulnerability in phpDocumentor 1.3.0 rc4 and earlier, when register_globals is enabled. Attackers can execute arbitrary code via URL in FORUM[LIB] or root_dir parameters.
SQL injection vulnerability in index.php of phpoutsourcing Zorum Forum 3.5 and earlier. Remote attackers can execute arbitrary SQL commands via the rollid parameter in the showhtmllist method.
Vulnerability in Xpdf library (Stream.cc) allows attackers to modify memory and potentially execute arbitrary code via specially crafted DCTDecode streams. The issue involves missing validation of values such as 'number of components', 'Huffman table index', and 'scanInfo.numComps' in functions DCTStream::readBaselineSOF, DCTStream::readProgressiveSOF, DCTStream::readHuffmanTables, and DCTStream::readScanInfo.
Drivers for certain display adapters, including an unspecified ATI driver and an unspecified Intel driver, may allow a remote attacker to cause a denial of service (system crash) via a large JPEG image. The attack was demonstrated in Internet Explorer using an image with dimensions of 9999999 pixels.
The vulnerability in Blue Coat Systems WinProxy before version 6.1a allows a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code by sending a large number of packets containing 0xFF characters to the Telnet port (TCP 23), which corrupts the heap.
Integer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified StripByteCounts or StripOffsets values.
An unspecified Accelerated Enterprise Solutions product, possibly Accelerated E Solutions, contains an SQL injection vulnerability in the password parameter. This allows remote attackers to execute arbitrary SQL commands.
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via the notify script (versions 4.2.0-4.2.3) or crafted CallID parameters to the faxrcvd script (versions 4.2.2-4.2.3).
Segue CMS before version 1.3.6 has an unrestricted file upload vulnerability that allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory, when Apache HTTP Server handles .phtml files with the PHP interpreter.
A buffer overflow vulnerability in the decompression algorithm of BlackBerry Enterprise Server 4.0 SP1 and earlier versions before 20050607 may allow a remote attacker to execute arbitrary code via specially crafted data packets.
Multiple SQL injection vulnerabilities were found in Sysbotz Systems Panel 1.0.6 and earlier. Remote attackers can execute arbitrary SQL commands via the cid, aid, letter, mid, and tid parameters in various PHP scripts.
SQL injection vulnerability in index.php of Appalachian State University phpWebSite 0.10.1 and earlier allows remote attackers to execute arbitrary SQL commands via the module parameter. The details are obtained solely from third party information.
VirtueMart before version 1.0.1 improperly handles errors when a user is forbidden to read a requested page. This vulnerability may have unknown impact and can be exploited remotely.
The tuxpaint-import.sh script in Tux Paint version 0.9.14 and earlier creates temporary files insecurely, which may lead to unknown impacts and attack vectors.
A vulnerability in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.