CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in resetcore.php in e107 versions 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the a_name parameter or user field of the login page.
Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the INCLUDE_PATH, SQUIZLIB_PATH, and PEAR_PATH parameters in several script files.
Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via banner.php or the id parameter in print.php, comment.php, and news.php.
SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.
SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.
A buffer overflow vulnerability in the swcons utility in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and potentially execute arbitrary code.
The vulnerability in the chfn tool in pwdutils version 3.0.4 and earlier on SuSE Linux (and possibly other operating systems) does not properly validate arguments for the GECOS field, allowing local users to gain privileges.
A vulnerability in ClamAV versions 0.80 through 0.87, in the FSG unpacker function (fsg.c), allows a remote attacker to cause memory corruption and execute arbitrary code via a crafted FSG 1.33 file.
Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields.
A vulnerability in Frisk F-Prot Antivirus allows remote attackers to bypass protection by sending a ZIP file with a version header greater than 15, which prevents the software from decompressing and analyzing the file.
Vulnerability in Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.
In Asus Video Security 3.5.0.0 and earlier, when using authorization, a buffer overflow occurs. A remote attacker can exploit a long username/password string to execute arbitrary code.
The libungif library before version 4.1.0 contains a memory corruption vulnerability via a crafted GIF file, which can lead to arbitrary code execution. The issue is caused by an out-of-bounds write.
SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter. Although the vendor disputed this report, further investigation confirms the vulnerability exists.
Vulnerability in Scorched 3D 39.1 (bf) and earlier allows a remote attacker to cause a denial of service (long loop and server hang) by sending a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.
A buffer overflow vulnerability in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name.
Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size.
Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various functions including GLConsole::addLine, ServerCommon::sendString, and ServerCommon::serverLog.
Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various functions including GLConsole::addLine, ServerCommon::sendString, ServerCommon::serverLog, a long command in ComsMessageHandler.cpp, a long UniqueID value in Logger.cpp, and possibly other unspecified vectors.
A vulnerability in Cisco IOS versions 12.0 to 12.4 may allow a remote attacker to execute arbitrary code via a heap-based buffer overflow in system timers. However, this is not a specific vulnerability but a general design weakness that increases the risk of exploiting other potential vulnerabilities.