CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in the VERITAS Backup Exec Web Administration Console (BEWAC) versions 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code.
A vulnerability in VERITAS Backup Exec 9.0 through 10.0 for Windows Servers and 9.0.4019 through 9.1.307 for Netware allows a remote attacker to cause a denial of service (Remote Agent crash) by sending a crafted packet to the NDMLSRVR.DLL library or a packet with an invalid (non-zero) 'Error Status' value, leading to a null pointer dereference.
Vulnerability in VERITAS Backup Exec Server (beserver.exe) versions 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106.
Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the iState parameter in default.asp or the iPro parameter in edit.asp.
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the User Name field (sUserName parameter) or Password (sPassword parameter).
Multiple SQL injection vulnerabilities in DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the iCat, iPro, and iSub parameters.
Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the iChannel, iData, iMem, iCat, offset, and iChannel parameters.
Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the iCat, iSub, iPro, and iType parameters in various ASP scripts.
Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the iMsg parameter to messages.asp, iFor parameter to post.asp or forums.asp, or id parameter to userEdit.asp. Vectors 1 and 3 were later reported to affect version 3.0.
PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
SQL injection vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Multiple SQL injection vulnerabilities in Fortibus CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via (1) the username or password to logon.asp, (2) WeeklyNotesDisplay.asp, or (3) the Search page.
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the username or id parameters.
The XMLRPC server in the Ruby library (libruby) 1.8 sets an invalid default value that prevents security protection using handlers, allowing remote attackers to execute arbitrary commands.
Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the ci, d, or m parameter to index.asp, or the bi parameter to blog_comment.asp.
Stack-based buffer overflow in VERITAS Backup Exec Remote Agent for Windows and Netware. An attacker can remotely execute arbitrary code by sending a specially crafted CONNECT_CLIENT_AUTH request with a long password.
The vulnerability in amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
PHP remote file inclusion vulnerability in siteframe.php for Broadpool Siteframe allows remote attackers to execute arbitrary code via a URL in the LOCAL_PATH parameter.