CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in HP HTTP Server versions 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
A remote file inclusion vulnerability in Siteframe before version 3.2.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the LOCAL_PATH parameter in web/classes.php.
Internet Explorer 6.0 (and possibly other versions) allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name). Some proxy servers convert tabs to spaces, enabling the attack.
SQL injection vulnerability in Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the SYS.DBMS_CDC_SUBSCRIBE and SYS.DBMS_CDC_ISUBSCRIBE packages.
The ath_rate_sample function in the sample code of MadWifi before version 0.9.3 allows remote attackers to cause a denial of service (system crash due to failed KASSERT) by moving a connected system to a location with low signal strength, and possibly other vectors related to a race condition between interface enabling and packet transmission.
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
In Net-SNMP versions 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, running in master agentx mode, the snmp_api.c function in snmpd contains a denial of service vulnerability. A remote attacker can crash the daemon by causing a specific TCP disconnect, which triggers a free of an incorrect variable.
The vulnerability in the System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
The vulnerability in Spectrum Cash Receipting System before version 6.504 uses weak cryptography (static substitution) in the PASSFILE password file. This allows local users to easily decrypt passwords and escalate their privileges.
A vulnerability in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.
A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.
A stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.
In IBM DB2 8.1, shared memory sections and events have default read and write permissions for the Everyone group, allowing local users to gain unauthorized access, obtain sensitive information such as cleartext passwords, and cause a denial of service.
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
SQL injection vulnerability in index.php of ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. The details are obtained solely from third party information as the original source is unavailable.
Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause a denial of service (crash) via the rlm_sqlcounter module or while expanding the %t token.
A heap-based buffer overflow in Novell Open Enterprise Server Remote Manager (novell-nrm) for Novell SUSE Linux Enterprise Server 9 allows remote attackers to execute arbitrary code via an HTTP POST request with a negative Content-Length parameter.
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, do not use the secure t3s protocol even when an Administration port is enabled on the Administration server. This could allow remote attackers to sniff the connection.
Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. The vulnerability was reported by third parties and details are not fully verified.
A vulnerability in BEA WebLogic Server and WebLogic Express versions 9.0, 8.1, and 7.0 locks out the admin account after multiple incorrect password guesses. A remote attacker who knows or guesses the admin account name can cause a denial of service (DoS) by blocking admin logins.