CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.
Vulnerability in HP OpenView Network Node Manager versions 6.2 through 7.50 allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the node, cdpView, freeIPaddrs, or ecscmg parameters in .ovpl scripts.
PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter.
A heap-based buffer overflow in the Sophos Antivirus Library allows remote attackers to execute arbitrary code via a crafted Visio file with a modified sub record length.
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allow remote attackers to bypass authentication via an unknown attack vector or a NULL (0x00) as a username.
Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field.
PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an 'ftp://' URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for 'http' and 'https' URLs.
A format string vulnerability in simpleproxy before version 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply.
A vulnerability in the Red Hat Enterprise Linux 3 kernel, in the init_dev function in tty_io.c, results from improper clearing of controlling ttys in multi-threaded applications. A local user can exploit this flaw to cause a system crash (denial of service) and potentially gain tty access through attacks that trigger a pointer to a freed structure.
Vulnerability in phpldapadmin before version 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.
Vulnerability in lockmail in maildrop before version 1.5.3. The program does not drop privileges before executing commands, allowing local users to gain privileges via command line arguments.
Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall, when compressed file scanning is enabled, allows remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.
SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie.
The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firewall rules and connect to local services.
A vulnerability in Symantec AntiVirus 9 Corporate Edition allows local users to gain privileges via the 'Scan for viruses' option, which launches a help window with raised privileges. This is a reintroduction of a vulnerability originally identified and addressed in CVE-2002-1540.
The vulnerability in upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.
A buffer overflow vulnerability in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using a video file with an audio header containing a large value in a stream format (strf) chunk.
The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.
PHP remote file inclusion vulnerability in WebCalendar before version 1.0.1. An attacker can remotely execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.