CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp.
D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensitive information.
A vulnerability in the D-Link DSL-504T router allows a remote attacker to bypass authentication and gain administrative privileges by making a direct request to the firmwarecfg resource. The attacker can then upgrade firmware, restart the device, or restore a saved configuration.
A format string vulnerability in the imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
An integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5, 0.6, and versions before 0.6.90 allows remote attackers to execute arbitrary code via a partial message request with a large END parameter, leading to a heap-based buffer overflow.
Buffer overflow vulnerability in the header_get_field_name function in header.c of GNU Mailutils versions 0.5, 0.6, and earlier than 0.6.90. A remote attacker can execute arbitrary code via a crafted email.
Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and Remote Management allows remote attackers to execute arbitrary code via unspecified vectors, type 1 authentication requests, and type 2 authentication requests.
Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail Server 8.2 Hotfix 2, allow remote attackers to execute arbitrary code via a LOGIN command with a long username argument or a long username argument that begins with a special character.
SQL injection vulnerability in admin.asp of FunkyASP AD System 1.1 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password parameter.
Stack-based buffer overflow in the IMAP daemon (IMAPD32.EXE) in IMail 8.13 and earlier versions before IMail Server 8.2 Hotfix 2 allows remote authenticated users to execute arbitrary code via a STATUS command with a long mailbox name.
SQL injection vulnerability in login.asp of ezdwc NewsletterEz 3.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
The vulnerability in qpopper 4.0.5 and earlier versions is due to improper dropping of privileges before processing user-supplied files. A local user can exploit this flaw to overwrite or create arbitrary files with root privileges.
Multiple SQL injection vulnerabilities in PROMS before version 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
Multiple unknown vulnerabilities in PROMS 0.11 allow non-authorized users to view or modify the project member list or modify the todos list.
Integer overflow vulnerability in Computer Associates Vet Antivirus library allows remote attackers to gain elevated privileges by sending a crafted compressed VBA directory with a project name length of -1, leading to a heap-based buffer overflow.
Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.
Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through Service Pack 5 fails to log out users when an application is redeployed, allowing continued access without re-authentication, potentially violating updated security constraints or role mappings.
An unknown vulnerability in ALWIL avast! antivirus version 4 (4.6.6230) and earlier, running on Windows NT 4.0, causes improper detection of certain viruses.
Format string vulnerability in the logPrintBadfile function in delbadfiles.c in Iron Bars SHell (ibsh) before 0.3d allows users to access files outside the home directory and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.
Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter.