CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unquoted Windows search path vulnerability in RealPlayer allows local users to gain privileges via a malicious C:\program.exe file.
An unquoted Windows search path vulnerability in Microsoft Antispyware 1.0.509 (Beta 1) might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder, involving the programs GIANTAntiSpywareMain.exe, gcASNotice.exe, gcasServ.exe, gcasSWUpdater.exe, or GIANTAntiSpywareUpdater.exe.
Lynx versions before 2.8.6dev.15 allow remote attackers to execute arbitrary system commands via lynxcgi:, lynxexec, and lynxprog links, which are not properly restricted in the default configuration in some environments.
Multiple directory traversal vulnerabilities in Tikiwiki before version 1.9.1 allow remote attackers to read arbitrary files and execute commands via the suck_url parameter to tiki-editpage.php or the language parameter to tiki-user_preferences.php.
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.
An unquoted Windows search path vulnerability in VMWare Workstation 5.0.0 build-13124 might allow local users to gain privileges via a malicious 'program.exe' file in the C: folder.
The CodeSupport.ocx ActiveX control, used by Sony to uninstall the First4Internet XCP DRM, has 'safe for scripting' enabled, which allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.
Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in category.php and info.php.
The vulnerability in the PNP_GetDeviceList (upnp_getdevicelist) function in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows a remote attacker to cause a denial of service (DoS) through excessive memory consumption. The attack involves sending a DCE RPC request with a large output buffer size.
Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in logout.php and index.php.
Vulnerability in IBM Informix Dynamic Database server on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username.
PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitrary files via the 'file' parameter, possibly due to a directory traversal vulnerability.
Multiple buffer overflows in the IMAP Groupware Mail server of Floosietek FTGate (FTGate4) 4.1 allow remote attackers to execute arbitrary code via long arguments to various IMAP commands, as demonstrated with the EXAMINE command.
Vulnerability in Oracle Databases running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication by supplying a valid username.
IBM DB2 database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account without supplying a password.
In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.
A buffer overflow vulnerability in FileZilla Server Terminal 0.9.4d allows remote attackers to cause a denial of service (terminal crash) by sending a long USER FTP command.
SQL injection vulnerability in the report module of ibProArcade 2.5.2 and earlier. Remote attackers can execute arbitrary SQL commands via the 'user' parameter in index.php.
SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer.