CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GeoVision Digital Video Surveillance System versions 6.04, 6.1 and 7.0 use a weak encryption scheme to protect passwords. This allows a remote attacker to obtain the password via network sniffing.
SQL injection vulnerability in view_user.php in WowBB 1.6, 1.61, and 1.62 allows remote attackers to execute arbitrary SQL commands via the sort_by parameter.
The vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the 'print' parameter.
A stack-based buffer overflow in libTIFF before version 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.
A heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrary commands via a large packet to port 20031.
The Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session, which causes the shell to crash and restart, then leave the user in the new shell.
APG Technology ClassMaster does not properly restrict access to sensitive folders, which allows remote attackers to access folders via a network share.
SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL commands via the entry parameter.
An integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to execute arbitrary code via crafted parameters.
A vulnerability in Bugzilla versions 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to enter bugs into products that are closed for bug entry by modifying the URL to specify the product name.
SQL injection vulnerability in topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Vulnerability in Firefox before 1.0.4 and Mozilla Suite before 1.7.8 due to improper privilege limitation of JavaScript eval and Script objects in the calling context, allowing remote attackers to perform unauthorized activities via non-DOM property overrides, a variant of CVE-2005-1160.
Vulnerability in Firefox before version 1.0.4 and Mozilla Suite before version 1.7.8 allows an attacker to execute script via specially crafted URLs with 'javascript:' prefix. The flaw results from improper implementation of security checks for script injection, allowing bypass of protection mechanisms.
Unknown vulnerability in the nfs_mount call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.
The new account wizard in Mail.app 2.0 in Mac OS 10.4, when configuring an IMAP mail account and checking the credentials, does not prompt the user to use SSL until after the password has already been sent, which causes the password to be sent in plaintext.
Multiple SQL injection vulnerabilities in Quick.Forum 2.1.6 allow remote attackers to execute arbitrary SQL commands via the iCategory or page parameter to index.php, or iCategory parameter in the query string to the forum directory.
Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) searchstring parameter to search_list.php, the (2) maingroup or (3) secondgroup parameters to item_list.php, or (4) code_no parameter to item_show.php.
In Oracle Database 9i and 10g, after the SYS user executes a SELECT statement on an FGA object, Fine Grained Audit (FGA) is disabled, making it easier for attackers to evade detection.
Vulnerability in MidiCart PHP Shopping Cart allows a remote attacker to obtain sensitive information by directly requesting search_list.php, item_list.php, or item_show.php files. The response includes a PHP error message revealing the system path.
Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.