CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.
Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing ("*") character followed by a long string.
PHP remote file inclusion vulnerability in last_gallery.php of YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIG_PATH parameter.
An unknown vulnerability in the privilege system of Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges due to an improperly implemented input check.
A direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.
Vulnerability in Sawmill before version 7.1.6 allows a remote attacker to bypass authentication and gain administrative privileges or add a license.
SQL injection vulnerability in Invision Blog before version 1.1.2 Final allows remote attackers to execute arbitrary SQL commands via the eid and mid parameters.
A vulnerability in Perception LiteWeb allows remote attackers to bypass access controls for files by adding an extra leading slash (/) or backslash (\) in the URL.
Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.
Multiple SQL injection vulnerabilities in Calendarix Advanced 1.5 allow remote attackers to execute arbitrary SQL commands via the catview parameter in cal_week.php, cal_cat.php, cal_day.php, and the id parameter in cal_pophols.php.
The vulnerability in Symantec Brightmail AntiSpam before version 6.0.2 involves a hard-coded database administrator password. A remote attacker can exploit this flaw to gain unauthorized privileges.
The vulnerability in hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Unknown vulnerability in FlexCast Audio Video Streaming Server before version 2.0. Details about impact and attack vectors are unknown.
SQL injection vulnerability in login.asp of JiRo's Upload System (JUS) 1 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.
PHP remote file inclusion vulnerability in utilit.php of Ovidentia Portal allows remote attackers to execute arbitrary PHP code via the babInstallPath parameter.
A vulnerability in the NFS service on Apple Mac OS X 10.4.x up to 10.4.1 causes the system to improperly obey the -network or -mask flags for a filesystem and exports it to everyone, allowing remote attackers to bypass intended access restrictions.
Loki download manager 2.0 contains SQL injection vulnerabilities in the password field in default.asp and the cat parameter in catinfo.asp. A remote attacker can exploit these flaws to execute arbitrary SQL commands.
SilverCity before version 0.9.5-r1 installs scripts cgi-styler-form.py, cgi-styler.py, and source2html.py with world-readable and world-writable permissions, allowing local users to execute arbitrary code.
The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries, as demonstrated using shell metacharacters in an FTP username.