CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.
A vulnerability in the NFS service on Apple Mac OS X 10.4.x up to 10.4.1 causes the system to improperly obey the -network or -mask flags for a filesystem and exports it to everyone, allowing remote attackers to bypass intended access restrictions.
SilverCity before version 0.9.5-r1 installs scripts cgi-styler-form.py, cgi-styler.py, and source2html.py with world-readable and world-writable permissions, allowing local users to execute arbitrary code.
PHP remote file inclusion vulnerability in start_lobby.php of MWChat 6.x allows remote attackers to execute arbitrary PHP code via the CONFIG[MWCHAT_Libs] parameter.
The upload.php script in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict file extensions for uploaded image files, allowing remote attackers to upload arbitrary files and execute arbitrary PHP code.
SQL injection vulnerability in login.asp of WWWeb Concepts Events System 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
A buffer overflow vulnerability in the administrative console of IBM WebSphere Application Server 5.x allows a remote attacker to execute arbitrary code when global security is enabled.
The sql_escape_string function in the mailutils SQL authentication module does not properly handle the backslash character (\), which is used as an escape character, making the module vulnerable to SQL injection attacks.
Multiple SQL injection vulnerabilities in Liberum Help Desk 0.97.3 allow remote attackers to execute arbitrary SQL commands via the 'id' parameter in view.asp and print.asp, and the 'edit' parameter in register.asp.
SQL injection vulnerability in login.asp in livingmailing 1.3 allows remote attackers to execute arbitrary SQL commands via the password parameter. There is little public information about this product and its vendor, and the original researcher announcement is no longer available.
Multiple SQL injection vulnerabilities in list.php in Exhibit Engine (EE) 1.22 allow remote attackers to execute arbitrary SQL commands via the search_row, sort_row, order, or perpage parameter.
PicoWebServer 1.0 contains a stack-based buffer overflow that can be exploited by a remote attacker via a long URL. This vulnerability may lead to application crash (denial of service) and potentially arbitrary code execution.
A directory traversal vulnerability in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allows remote attackers to read arbitrary files via a TFTP GET request containing "../" or "..\" sequences.
PHP remote file inclusion vulnerability in pdl_header.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php.
Fortinet firewall running FortiOS 2.x contains a hardcoded username with the password set to the serial number, which allows local users with console access to gain privileges.
Microsoft Terminal Server using RDP 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, allowing remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.
SQL injection vulnerability in resellerresources.asp in Hosting Controller 6.1 Hotfix 2.0 allows remote attackers to execute arbitrary SQL commands via the jresourceid parameter.
Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via parameters in various PHP scripts.
Multiple stack-based buffer overflows in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allow remote attackers to execute arbitrary code via a long (1) filename or (2) transfer mode string in a Read Request (RRQ) or Write Request (WRQ) packet.
A vulnerability in zboard.php in Zeroboard versions 4.1pl2 to 4.1pl5 allows remote attackers to execute arbitrary PHP code due to improper quoting when using the preg_replace function.