CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the wn_userpw parameter in startup.php, cat, id, or stof parameters in news.php, and id parameter in print.php.
The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as demonstrated using .inc files.
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the login field in login.php or the LocationID parameter in week.php.
SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.
Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.
The vulnerability in the umount tool from util-linux (versions 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2) and other packages such as loop-aes-utils allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, effectively clearing the nosuid, nodev, and other flags.
Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all soft hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.
Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses.
The ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a blank password and gain unauthorized access.
SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.
Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the config[root_dir] parameter to various .inc.php files.
Buffer overflow vulnerability in the Firewall Authentication Proxy for FTP and/or Telnet Sessions in Cisco IOS versions 12.2ZH, 12.2ZL, 12.3, 12.3T, 12.4, and 12.4T. A remote attacker can exploit crafted user authentication credentials to cause a denial of service (DoS) and potentially execute arbitrary code.
Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username.
Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to admin_main.php.
Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy).
A stack-based buffer overflow exists in the WinACE UNACEV2.DLL third-party compression utility before version 2.6.0.0, used in multiple products including ALZip, Servant Salamander, Total Commander, PowerArchiver, IZArc, and others. An attacker can execute arbitrary code by tricking a user into opening a crafted ACE archive with a long filename.
A buffer overflow vulnerability in MMClient.exe of Indiatimes Messenger 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long group name argument to the RenameGroup function in the MMClient.MunduMessenger.1 ActiveX object.
A vulnerability in the img.pl script in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.
PHP remote file inclusion vulnerability in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter in lang.php.