CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in conjunction with the login/userinfo.php path and the session parameter (aka the PHPKITSID variable).
The suid.cgi scripts in F-Secure Internet Gatekeeper for Linux before version 2.15.484 and Anti-Virus Linux Gateway before version 2.16 are installed with SUID permissions and world-executable, allowing local users to escalate privileges.
The envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.
A vulnerability in Zone Labs (ZoneAlarm) software allows remote attackers to bypass the 'Advanced Program Control and OS Firewall filters' setting using URLs in HTML Modal Dialogs (window.location.href) embedded in JavaScript tags.
SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields in adminlogin.asp.
SQL injection vulnerability in admin.php in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the username field.
Vulnerability in GDAL before version 1.3.0-r1 allows local users in the portage group to escalate privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.
A buffer overflow vulnerability has been discovered in the LZX decompression function of CHM Lib (chmlib) version 0.35, used in products such as KchmViewer. The impact and attack vectors are unknown.
SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.
The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer.
An unknown vulnerability in the remshd daemon on HP-UX B.11.00, B.11.11, and B.11.23 running in Trusted Mode allows remote attackers to gain unauthorized system access via unknown attack vectors.
SQL injection vulnerability in the report module of ibProArcade 2.5.2 and earlier. Remote attackers can execute arbitrary SQL commands via the 'user' parameter in index.php.
A SQL injection vulnerability was found in the index.php file of Peel versions 2.6 through 2.7. Remote attackers can execute arbitrary SQL commands via the rubid parameter.
In Clam AntiVirus (ClamAV) before version 0.87.1, improper boundary checks in petite.c allow attackers to perform unknown attacks via unknown vectors.
A buffer overflow vulnerability in FileZilla Server Terminal 0.9.4d allows remote attackers to cause a denial of service (terminal crash) by sending a long USER FTP command.
Macromedia Flash plugin (Flash.ocx 7.0.19.0 and earlier for Windows, libflashplayer.so before 7.0.25.0 for Unix) is vulnerable to a crash and potential arbitrary code execution via a crafted SWF file. The issue occurs when calling ActionDefineFunction in ActionScript, leading to improper memory access.
A format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.
A buffer overflow vulnerability in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name and then executing the XPWD command.