CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the crn parameter in a show action or rn parameter in a show_detail action.
Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when using the hugemem kernel, allows local users to read and write to arbitrary kernel memory and gain privileges via certain syscalls.
Vulnerability in the SimpleXMLRPCServer module in Python 2.2, 2.3 before 2.3.5, and 2.4 allows remote attackers to read or modify module globals and potentially execute arbitrary code when an XML-RPC server uses register_instance without a _dispatch method.
PHP remote file inclusion vulnerability in index.php of All4WWW-Homepagecreator 1.0a allows remote attackers to execute arbitrary PHP code by modifying the 'site' parameter to reference a URL on a remote server containing malicious code.
A format string vulnerability in Xpand Rally version 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
Heap-based buffer overflow in less in Red Hat Enterprise Linux 3 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file, as demonstrated using the UTF-8 locale.
A format string vulnerability in bidwatcher before version 1.3.17 allows remote malicious web servers from eBay or a spoofed eBay server to cause a denial of service and possibly execute arbitrary code via certain responses.
Buffer overflow vulnerability in the Decrypt::makeFileKey2 function in xpdf version 3.00 and earlier allows remote attackers to execute arbitrary code via a specially crafted PDF file with a large /Encrypt /Length keyLength value.
A format string vulnerability in IDA Pro 4.7.0.830 allows remote or local attackers to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a DLL name.
Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the library.
The vulnerability in the TCP design involves the lack of checking whether the TCP sequence number in an ICMP error message falls within the range of sequence numbers for sent but unacknowledged data. This allows attackers to forge ICMP messages for specific TCP connections, leading to denial-of-service (DoS) attacks via connection resets, throughput reduction, or Path MTU reduction.
Vulnerability in poppassd_pam 1.0 and earlier allows remote attackers to change passwords for arbitrary users without verifying the old password.
Multiple SQL injection vulnerabilities in mod.php of phpCOIN versions 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via parameters such as faq_id, id, topic_id, ord_id, dom_id, or invd_id in various modules.
SQL injection vulnerability in the Query Designer for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote attackers to execute arbitrary SQL via an imported file.
Vulnerability in Shoutbox SCRIPT 3.0.2 and earlier allows remote attackers to obtain sensitive information via a direct request to db/settings.dat, which displays usernames and password hashes.
By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases, via a full pathname in a GET or PUT request.
The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by sniffing the connection on TCP port 51100 and replaying the authentication information or obtaining and replaying the PCZQX02 authentication cookie from the browser.
SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
Buffer overflow vulnerability in Sun Java System Web Proxy Server (also known as Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors.
The custom avatar uploading feature (uploader.php) in XOOPS 2.0.9.2 and earlier does not filter file extensions, allowing remote attackers to upload arbitrary PHP scripts.