CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to execute arbitrary SQL commands via the Match or CatID parameter in SearchResults.php or the password in AccessControl.php.
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM/CAFT) versions 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
SQL injection vulnerability in modcp.php in WoltLab Burning Board 2.2.2 and 2.3.3 allows remote authenticated attackers to execute arbitrary SQL commands via the x or y parameters.
Buffer overflow in Sysinternals Process Explorer 9.23 and earlier versions before 9.25 allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process.
The vulnerability in the SpellChecker plugin in DTLink AreaEdit before version 0.4.3 allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the 'dictionary' parameter (also known as the 'lang' variable) in the aspell_setup.php file.
An unknown vulnerability in the Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to bypass authentication.
A vulnerability in the gorum/prod.php script in Zorum 3.5 allows remote attackers to execute arbitrary code by injecting shell metacharacters into the argv parameter.
A buffer overflow in the mutt_decode_xbit function in Handler.c of Mutt 1.5.10 may allow remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
Vulnerability in Computer Associates Message Queuing (CAM/CAFT) versions 1.05, 1.07 before build 220_13, and 1.11 before build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
A buffer overflow vulnerability in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Jtext field.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to execute arbitrary SQL commands via parameters in forums.php, list.php, journal.php, and links.php. The vendor has disputed this issue, stating that variables are properly sanitized.
Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7 allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.
SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before version 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter.
The vulnerability in nquser.php in Virtual Edge Netquery 3.11 allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters into the host parameter of a dig query.
The vulnerability in the checkBlacklist function in CPAINT is due to an incomplete blacklist. A remote attacker can bypass the security and execute arbitrary commands using the ExecuteGlobal function or GetRef statement, which are not included in the blacklist.
A buffer overflow vulnerability in servermgrd on Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.
Unknown vulnerability in Mac OS X 10.4.2 and earlier, when using Kerberos authentication with LDAP, allows attackers to gain access to a root Terminal window.
A buffer overflow vulnerability in Directory Services on Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.
Buffer overflow in ping in Mac OS X 10.3.9 allows local users to execute arbitrary code.
The System Profiler in Mac OS X 10.4.2 labels a Bluetooth device with 'Requires Authentication: No' even when the user has selected the 'Require pairing for security' option, which could confuse users about which setting is valid.