CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in security.c in hcid for BlueZ versions 2.16, 2.17, and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka 'Web Folder Behaviors Cross-Domain Vulnerability'.
Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.
Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to elevate privileges or execute arbitrary code via a crafted message.
A buffer overflow vulnerability in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.
Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
The vulnerability in pstotext before version 1.8g is due to improper use of the "-dSAFER" option when calling Ghostscript to extract plain text from PostScript and PDF files. This allows a remote attacker to execute arbitrary commands via a malicious PostScript file.
A buffer overflow vulnerability in the Discovery Service of BrightStor ARCserve Backup versions 9.0 through 11.1 allows a remote attacker to execute arbitrary commands by sending a large packet to TCP port 41523. This is a different vulnerability than CVE-2005-0260.
A buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol.
SQL injection vulnerability in mod_forum/read_message.php in PortailPHP allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php with the affiche parameter set to 'Forum-read_mess'. This is a different vulnerability than CVE-2005-1701.
Vulnerability in Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php.
Eval injection vulnerability in Karrigell before 2.1.8 allows remote attackers to execute arbitrary Python code via modified arguments to a Karrigell services (.ks) script, which can reference functions from libraries that are used by that script.
Buffer overflow vulnerability in the rdb_query function in Denora IRC Stats 1.0 may allow attackers to execute arbitrary code.
SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel.
The pstopnm tool in netpbm improperly uses the "-dSAFER" option when calling Ghostscript to convert a PostScript file into PBM, PGM, or PNM formats. This allows external user-assisted attackers to execute arbitrary commands.
Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via various parameters in multiple PHP scripts.
Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port 6070 or 6050.
Unknown vulnerability in apt-cacher in Debian 3.1, related to 'missing input sanitising,' allows remote attackers to execute arbitrary commands on the caching server.
Multiple SQL injection vulnerabilities in Contrexx before version 1.0.5 allow remote attackers to execute arbitrary SQL commands via the 'value' parameter in the poll module or the 'pId' parameter in the gallery module.
B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg.