CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, or a long SSI command.
Vulnerability in message.htm in Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter.
Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via the Folder.Id parameter to (1) deletefolder.ctml, (2) deletemessage.ctml, (3) origmessage.ctml, or (4) readmessage.ctml, the Message.Id parameter to editmessage.ctml, or the (5) Message.Command parameter to messages.ctml.
The vulnerability in Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, allowing remote attackers to obtain and decrypt usernames and passwords.
Gurgens (GASoft) Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords.
The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as the IP of the logged in user, which allows remote attackers to conduct FTP Bounce attacks to bypass firewall rules or cause a denial of service.
The vulnerability in HTMLJunction EZGuestbook involves storing the guestbook.mdb file under the web document root with insufficient access control. A remote attacker can access this file and obtain sensitive information, including the administrative password.
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
In Woppoware PostMaster 4.2.2 (build 3.2.5), the message.htm file contains a directory traversal vulnerability. A remote attacker can determine the existence of arbitrary files on the server by providing a '..' sequence in the wmm parameter.
Vulnerability in YusASP Web Asset Manager 1.0 allows remote attackers to gain elevated privileges via a direct request to assetmanager.asp.
SQL injection vulnerability in Sigmaweb.DLL in Sigma ISP Manager 6.6 allows remote attackers to execute arbitrary SQL commands via the username, password, or domain fields.
The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X use the current working directory to find and execute the productname.sh script, which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.
SQL injection vulnerability in member.php in Photopost PHP Pro allows remote attackers to execute arbitrary SQL commands via the verifykey parameter.
In the Linux kernel 2.6.x, raw character devices (raw.c) call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space. This vulnerability is similar to CVE-2005-1589.
Vulnerability in apage.cgi in WebAPP 0.9.9.2.1 and earlier versions allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.
The vulnerability in mod_channel.bas in ignitionServer 0.3.0 to 0.3.6 does not properly verify whether a host has the owner privileges required to delete IRC channel access entries, allowing remote attackers to bypass intended restrictions.
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
Unknown vulnerability in Attachment Mod before version 2.3.13, related to a serious issue with realnames, has unknown impact and attack vectors.
Multiple SQL injection vulnerabilities in JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via parameters such as anzahl_beitraege, year, tag, id, and the Accept-Language header.
SQL injection vulnerability in the verify_email function in Woltlab Burning Board 2.x and earlier allows remote attackers to execute arbitrary SQL commands via the $email variable.