CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php of AlmondSoft Almond Classifieds 5.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
A heap-based buffer overflow in Citrix Program Neighborhood client version 9.0 and earlier allows remote attackers to execute arbitrary code by sending a long name value in an Application Set response.
Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, when compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response.
A vulnerability in the Westell Versalink 327W router allows a remote attacker to cause a denial of service (device crash) by sending an IP packet with the same source and destination IP addresses and ports, with the SYN flag set (known as a Land attack).
Untrusted search path vulnerability in Perl before 5.8.7-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
PHP remote file inclusion vulnerability in MarmaraWeb E-commerce allows remote attackers to execute arbitrary code via the 'page' parameter in index.php.
Unspecified vulnerability in PhpLogCon before version 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving 'smart' values for userid and password, probably related to an SQL injection vulnerability in the pass and usr parameters in submit.php.
The vulnerability in Qt-UnixODBC before version 3.3.4-r1 on Gentoo Linux is due to an untrusted search path. A local user in the portage group can exploit a malicious shared object placed in the Portage temporary build directory, which is part of the RUNPATH, leading to privilege escalation.
Wireless Access Points from Avaya and Proxim use a static WEP key of "12345", allowing remote attackers to bypass authentication.
The vulnerability in CMake before version 2.2.0-r1 on Gentoo Linux is due to an untrusted search path. A local user in the portage group can place a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH, leading to privilege escalation.
A vulnerability in the Scientific Atlanta DPX2100 Cable Modem allows a remote attacker to cause a denial of service (device crash) by sending an IP packet with the same source and destination IP addresses and ports, with the SYN flag set (also known as a Land attack). The attack can be performed using the hping2 tool.
A vulnerability in AppServ Open Project 2.5.3 allows a remote attacker to cause a Denial of Service (DoS) by sending a large HTTP request.
Buffer overflow vulnerability in the malloc debug system in IBM AIX 5.3 allows local users to execute arbitrary code.
Multiple buffer overflows in IBM AIX versions 5.1, 5.2, and 5.3 in the muxatmd and slocal programs allow remote attackers to execute arbitrary code on the vulnerable system.
A vulnerability in mshtml.dll of Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by processing button-focus events simultaneously with document reloading, as observed in Microsoft Office InfoPath 2003 when repeatedly clicking the 'Delete' button in a repeating section of a form.
Buffer overflow vulnerability in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.
Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via parameters in various PHP scripts.
Vulnerability in Linksys WRT54GS and BEFW11S4 routers allows a remote attacker to cause a device crash (denial of service) by sending an IP packet with the same source and destination IP addresses and ports, with the SYN flag set (LAND attack).
Multiple SQL injection vulnerabilities in index.php in PHP Support Tickets 2.0 allow remote attackers to execute arbitrary SQL commands via the username and password fields, and the id parameter.
SQL injection vulnerability in view_Results.php in DreamLevels DreamPoll 3.0 final allows remote attackers to execute arbitrary SQL commands via the id parameter.