CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In freeFTPd before version 1.0.9 with Logging enabled, a stack-based buffer overflow exists. A remote attacker can use a long USER command to cause a denial of service (application crash) and potentially execute arbitrary code.
A stack-based buffer overflow in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to execute arbitrary code via a long mailbox name in the select, create, delete, rename, subscribe, or unsubscribe commands.
The Transmission Control Protocol (TCP) allows remote attackers to cause a denial of service (bandwidth consumption) by sending ACK messages for packets that have not yet been received (optimistic ACKs), which can cause the sender to increase its transmission rate until it fills available bandwidth.
Multiple SQL injection vulnerabilities in Wizz Forum 1.20 allow remote attackers to execute arbitrary SQL commands via the AuthID parameter in ForumAuthDetails.php, and the TopicID parameter in ForumTopicDetails.php and ForumReply.php.
SQL injection vulnerability in the WF-Downloads module 2.05 for XOOPS allows remote attackers to execute arbitrary SQL commands via the 'list' parameter in viewcat.php.
SQL injection vulnerability in download.php of PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the file parameter.
Buffer overflow in RealNetworks RealPlayer 10 and 10.5 allows remote attackers to execute arbitrary code via a crafted image in a RealPlayer Skin (RJS) file.
SQL injection vulnerability in the admin panel of ActiveCampaign 1-2-All Broadcast Email allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username field.
A stack-based buffer overflow in the IMAP daemon in Novell Netmail 3.5.2 allows remote attackers to execute arbitrary code via long verb arguments.
The IKEv1 implementation in Openswan 2 before 2.4.4 and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23 allows remote attackers to cause a denial of service via a crafted packet using 3DES with an invalid key length or unspecified inputs when Aggressive Mode is enabled and the PSK is known.
The IKEv1 implementation in Check Point products is vulnerable to a DoS attack via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Due to lack of details, it is unclear which specific CVE (CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668) this issue applies to.
Multiple unspecified format string vulnerabilities in various IKEv1 implementations, discovered by the PROTOS ISAKMP Test Suite, allow attacks through unspecified vectors leading to unknown impacts. Due to lack of details in original sources, this candidate is likely to be rejected once vulnerable implementations are identified.
Multiple unspecified vulnerabilities in the IKEv1 implementation in HP-UX, Jetdirect, and Tru64 UNIX allow remote attackers to cause a denial of service via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
The IKEv1 implementation in the libike library in Sun Solaris 9 and 10 allows a remote attacker to cause a denial of service (in.iked crash) by sending crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
A heap-based buffer overflow in the Kaspersky Anti-Virus Engine, used in Kaspersky Personal 5.0.227, Anti-Virus On-Demand Scanner for Linux 5.0.5, and F-Secure Anti-Virus for Linux 4.50, allows remote attackers to execute arbitrary code via a crafted CHM file.
Unquoted Windows search path vulnerability in Kaspersky Anti-Virus 5.0 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.
A vulnerability in the gdk-pixbuf library of GTK+ before version 2.8.7 allows an attacker to cause an infinite loop via a crafted XPM image with a large number of colors, leading to a denial of service (DoS).
Multiple directory traversal vulnerabilities in Tikiwiki before version 1.9.1 allow remote attackers to read arbitrary files and execute commands via the suck_url parameter to tiki-editpage.php or the language parameter to tiki-user_preferences.php.
An integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values.
Stack-based buffer overflow in a shared library used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5.1 up to MP3A allows remote attackers to execute arbitrary code via a crafted packet.