CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.
A vulnerability in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.
The vulnerability in Spectrum Cash Receipting System before version 6.504 uses weak cryptography (static substitution) in the PASSFILE password file. This allows local users to easily decrypt passwords and escalate their privileges.
The vulnerability in the System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
SQL injection vulnerability in post.php of PhpTagCool 1.0.3 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field in an HTTP header.
SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.
A vulnerability in the PEAR Text_Password 1.0 library stems from improper seeding of the random number generator, potentially leading to predictable password generation. The exact impact and attack vectors are unspecified.
In Net-SNMP versions 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, running in master agentx mode, the snmp_api.c function in snmpd contains a denial of service vulnerability. A remote attacker can crash the daemon by causing a specific TCP disconnect, which triggers a free of an incorrect variable.
BEA WebLogic Server and WebLogic Express versions 8.1 SP3 and earlier, and 7.0 SP5 and earlier, improperly constrain a slash (/) servlet root URL pattern. This could allow a remote attacker to bypass intended servlet protections.
A vulnerability in BEA WebLogic Server and WebLogic Express causes the boot password to be stored in cleartext in the registry. A local user can read it and gain unauthorized administrative access.
A vulnerability in BEA WebLogic Server and WebLogic Express may inadvertently expose passwords in IIOP exception messages. When IIOP is used, a password can be included in an error message sent to a client or stored in a log file.
SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter in a manageaccount action to index.php.
Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, NetBSD-2 before 20050913, and NetBSD-1.6 before 20050914. Local users can cause heap corruption, system crash, and potentially gain root privileges.
Multiple unspecified vulnerabilities in the web utility function in Hitachi Cm2/Network Node Manager and JP1/Cm2/Network Node Manager before September 30, 2005 allow attackers to execute arbitrary commands, disable services, and exploit other vulnerabilities.
A stack-based buffer overflow in the as_bad function in messages.c in GNU Binutils before July 21, 2005 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.
A buffer overflow vulnerability exists in the reset_vars function in config/tc-crx.c of the GNU as (gas) assembler in GNU Binutils before July 14, 2005. This flaw can be exploited via a crafted .s file, potentially leading to unknown impacts.
The SISCO OSI stack for Windows, used in MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service (process crash) via certain network traffic, as demonstrated using a Nessus scan.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.