CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Format string vulnerability in the logging functionality in BitDefender AntiVirus 7.2 through 9 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in file or directory name.
Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.
The vulnerability in login.php of myBloggie 2.1.3 beta and earlier allows an attacker to bypass a whitelist check using a null character in the username parameter, enabling SQL injection. Although the whitelist check succeeds, the null character injects SQL into the query.
Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execute arbitrary code via format strings in filenames.
The vulnerability in Procom NetFORCE 800 version 4.02 M10 Build 20 (and possibly other versions) causes the NIS password map (passwd.nis) to be sent as a file attachment in diagnostic email messages, allowing remote attackers to obtain cleartext NIS password hashes.
Heap-based buffer overflow in Kaspersky Antivirus 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arbitrary code via a CAB file with large records after the header.
Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
Buffer overflow vulnerability in the get_string_ahref function of ProZilla 1.3.7.4 and possibly earlier versions, with the -ftpsearch option enabled. A remote server can execute arbitrary code by sending a crafted string in the HREF field of an <A> tag in a search response.
Vulnerability in Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy restrictions by downloading the launch.ica file and changing the client device name (ClientName).
Buffer overflow vulnerability in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename.
SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login field.
Buffer overflow vulnerability in the getconf tool in IBM AIX versions 5.2 through 5.3 allows a local user to execute arbitrary code via unknown vectors.
Buffer overflow vulnerability in the ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long third argument to the GotNate.Excute method.
The ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to download and execute arbitrary programs by setting the arguments to the GotNate.Excute method.
The Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.
Heap-based buffer overflow in Image-Line Software FL Studio 5.0.1 allows remote attackers to execute arbitrary code via a .flp file containing a long path to a .mid or .wav file.
A vulnerability in the nslookup.cgi program by Avi Alkalay, dated June 16, 2002, allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the query parameter.
The notify program by Avi Alkalay, dated 19 Aug 2001, contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the 'from' parameter.
Stack-based buffer overflow in AbiWord before version 2.2.10 allows attackers to execute arbitrary code via the RTF import mechanism.
SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.