CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg.
Multiple SQL injection vulnerabilities in index.php and other pages in Beehive Forum allow remote attackers to execute arbitrary SQL commands via the webtag parameter.
Stack-based buffer overflow in Ares FileShare 1.1 allows remote or local attackers to execute arbitrary code via a long history parameter in the configuration file (ares.conf) or a long search string.
The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze.
Multiple integer overflows in the TNEF, CHM, and FSG file format processors in libclamav for ClamAV 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message.
The vulnerability in the flsearch.pl script of FtpLocate 2.02 allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in an HTTP GET request.
SQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the 'id' argument to admin pages such as 'members' or 'admin'.
Buffer overflow vulnerability in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section.
SQL injection vulnerability in viewPrd.asp in Product Cart 2.6 allows remote attackers to execute arbitrary SQL commands via the idcategory parameter.
SQL injection vulnerability in UseBB 0.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search function.
The Gopher client version 3.0.5 contains a vulnerability in gopher.c that improperly creates temporary files, allowing local users to escalate privileges.
Heap-based buffer overflow in the Admin Plus Pack Option for VERITAS Backup Exec 9.0 through 10.0 for Windows Servers allows remote attackers to execute arbitrary code.
A format string vulnerability in the nm_info_handler function in Network Manager may allow remote attackers to execute arbitrary code via format string specifiers in a Wireless Access Point identifier, which is not properly handled in a syslog call.
Format string vulnerability in util.c in nbsmtp 0.99 and earlier, while running in debug mode, allows remote attackers to execute arbitrary code via format string specifiers that are not properly handled in a syslog call.
A buffer overflow vulnerability in the UNACEV2.DLL library used by avast! Antivirus allows a remote attacker to execute arbitrary code via a crafted ACE archive with a long filename.
Multiple stack-based buffer overflows in GoodTech SMTP server 5.16 allow remote attackers to execute arbitrary code via a specially crafted RCPT TO command with a long DNS name or a large number of RCPT TO commands with a long email name argument in the last command.
A buffer overflow vulnerability in a USB driver for Microsoft Windows allows attackers to execute arbitrary code.
PHP Surveyor 0.98 contains multiple SQL injection vulnerabilities in the sid, start, id, and lid parameters across various scripts. They allow a remote attacker to execute arbitrary SQL commands.
PHP Surveyor 0.98 allows remote attackers to trigger SQL errors via missing parameters to (1) browse.php, (2) export.php, (3) conditions.php, or (4) spss.php.
The inc.login.php script in PHPFinance 0.3 allows remote attackers to bypass the login and gain privileges.