CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in Novell Open Enterprise Server Remote Manager (novell-nrm) for Novell SUSE Linux Enterprise Server 9 allows remote attackers to execute arbitrary code via an HTTP POST request with a negative Content-Length parameter.
Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 are vulnerable to a denial of service attack via a long crafted string sent to port 7800 (GUI Server) or 7801 (Device Server), causing server components to crash or hang, though they are automatically restarted.
Multiple SQL injection vulnerabilities in PHPSurveyor before version 0.991 allow remote attackers to execute arbitrary SQL commands via the sql parameter in browse.php and the sid, lid, gid, and token parameters in other PHP scripts.
In Plogger Beta 2, the file plog-admin-functions.php contains a PHP remote file inclusion vulnerability. An attacker can execute arbitrary code by providing a URL in the config[basedir] parameter.
SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter. This is a different vulnerability than CVE-2005-3875.
Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form.
Buffer overflow in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E. A remote attacker can exploit crafted IKE packets, potentially leading to unspecified impacts, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
A stack-based buffer overflow in index.fts of FTGate 4.4 (Build 4.4.000 Oct 26 2005) allows remote attackers to execute arbitrary code via a long tzoffset value.
An unspecified vulnerability in the GTP dissector of Ethereal versions 0.9.1 through 0.10.13 allows remote attackers to cause an infinite loop, resulting in a denial of service (DoS). The attack can be carried out via unknown vectors.
A format string vulnerability in the IKEv1 implementation in ADTRAN NetVanta before version 10.03.03.E may allow a remote attacker to cause an unknown impact by sending crafted IKE packets containing format string specifiers, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Electric Sheep 2.6.3 does not require authentication or integrity checks between server and client, allowing remote attackers to download and display arbitrary MPEG files via DNS spoofing, command-line URL, or configuration file URL. The description notes similar attack vectors apply to web browsers, questioning its specificity.
Multiple format string vulnerabilities in FTGate 4.4 POP3 (USER, PASS, TOP) and IMAP (LIST, AUTHENTICATE) commands allow remote attackers to execute arbitrary code via crafted format specifiers.
IKEv1 implementations in FortiOS, FortiClient, and FortiManager allow remote attackers to cause a denial of service by sending IKE packets with invalid IPSec attribute values. The attack terminates a process that is automatically restarted.
Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the GroupsId and ItemsId parameters in admin.php.
The vulnerability in rssh versions 2.0.0 through 2.2.3 allows local users to bypass access restrictions and gain root privileges by using the rssh_chroot_helper command to chroot to an external directory.
A vulnerability in the Windows GDI32.DLL library allows remote code execution via a crafted WMF image with a SETABORTPROC GDI Escape call, affecting the Picture and Fax Viewer (SHIMGVW.DLL). This flaw was originally exploited in the wild on unionseek.com.
Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the cat parameter in openforum.php and getfile.php, and the target parameter in download_now.php.
In eggblog 2.0, the search.php file mishandles the q parameter, allowing an attacker to disclose the full server path. This issue may be related to an SQL injection vulnerability.
The slsmgr and slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, allowing local users to gain privileges.
A buffer overflow vulnerability exists in Golden FTP Server 1.92 when handling the APPE command. Remote attackers can exploit this to execute arbitrary code on the server.