CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote file inclusion vulnerability in Siteframe before version 3.2.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the LOCAL_PATH parameter in web/classes.php.
A buffer overflow vulnerability in HP HTTP Server versions 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
SQL injection vulnerability in project-edit.asp of Digger Solutions Intranet Open Source (IOS) version 2.7.2. Attackers can execute arbitrary SQL commands via the project_id parameter.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including the m parameter in auth.php, the f parameter in events.php, or the e parameter in plug.php.
A format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before version 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code by injecting format strings into the wprintw function.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
The SISCO OSI stack for Windows, used in MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service (process crash) via certain network traffic, as demonstrated using a Nessus scan.
A vulnerability in NetBSD allows a local user to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials.
Multiple RealNetworks products including RealPlayer 10.x, RealOne Player, and Helix Player have a heap-based buffer overflow in the embedded player. A remote malicious server can cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response where the chunk header length is -1, less than actual data, or missing.
A vulnerability in util-vserver before version 0.30.208-1 and kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 contains a vulnerability that allows remote authenticated users to cause a denial of service (high CPU consumption) by abnormally terminating a connection, which prevents db2agents from being properly cleared.
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allows remote authenticated users to execute arbitrary commands via shell metacharacters in the fpr and keyserver parameters.
The FTP component in FortiGate devices running FortiOS 2.8MR10, v3beta, and versions prior to 3.0 MR1 allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP.
The vulnerability in ISS BlackIce 3.6, used in multiple products, involves a failure to drop privileges before launching help from the 'More Info' button in the 'Application Protection' dialog. This allows local users to execute arbitrary programs as SYSTEM.
Buffer overflow in Domain Name Relay Daemon (DNRD) before version 2.19.1 allows remote attackers to execute arbitrary code by sending a large number of large DNS packets with the Z and QR flags cleared.
A heap-based buffer overflow vulnerability in Research in Motion (RIM) BlackBerry Attachment Service allows remote attackers to cause a denial of service (hang) via an email attachment with a crafted TIFF file.
A vulnerability in Research in Motion (RIM) BlackBerry Router allows a remote attacker to cause a denial of service (communication disruption) via crafted Server Routing Protocol (SRP) packets.
Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allows remote attackers to delete arbitrary files via a ZIP, UUE or TAR archive that contains a .. (dot dot) in the filename, which is not properly handled when generating a preview.
Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allow remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets, as demonstrated by 'OpenSSL ASN.1 brute forcer'.