CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
The ath_rate_sample function in the sample code of MadWifi before version 0.9.3 allows remote attackers to cause a denial of service (system crash due to failed KASSERT) by moving a connected system to a location with low signal strength, and possibly other vectors related to a race condition between interface enabling and packet transmission.
In IBM DB2 8.1, shared memory sections and events have default read and write permissions for the Everyone group, allowing local users to gain unauthorized access, obtain sensitive information such as cleartext passwords, and cause a denial of service.
SQL injection vulnerability in Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the SYS.DBMS_CDC_SUBSCRIBE and SYS.DBMS_CDC_ISUBSCRIBE packages.
Internet Explorer 6.0 (and possibly other versions) allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name). Some proxy servers convert tabs to spaces, enabling the attack.
A remote file inclusion vulnerability in Siteframe before version 3.2.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the LOCAL_PATH parameter in web/classes.php.
Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to the utility used to update Java shared archives.
A buffer overflow vulnerability in HP HTTP Server versions 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
SQL injection vulnerability in project-edit.asp of Digger Solutions Intranet Open Source (IOS) version 2.7.2. Attackers can execute arbitrary SQL commands via the project_id parameter.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including the m parameter in auth.php, the f parameter in events.php, or the e parameter in plug.php.
A format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before version 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code by injecting format strings into the wprintw function.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
The SISCO OSI stack for Windows, used in MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service (process crash) via certain network traffic, as demonstrated using a Nessus scan.
A vulnerability in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allows remote authenticated users to execute arbitrary commands via shell metacharacters in the fpr and keyserver parameters.
Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 may allow context-dependent attackers to execute arbitrary code via long function parameters, as demonstrated in cups_get_dest_options.
The FTP component in FortiGate devices running FortiOS 2.8MR10, v3beta, and versions prior to 3.0 MR1 allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP.
The vulnerability in the System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.