CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP remote file inclusion vulnerability in content.php and index.php of Vortex Portal allows remote attackers to execute arbitrary PHP code via a URL in the act parameter.
Buffer overflow vulnerability in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.
Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the intProdID parameter in product.asp or strCatalog_NAME parameter in productsByCategory.asp.
Multiple buffer overflows in Cyrus IMAPd before version 2.2.11 may allow attackers to execute arbitrary code via an off-by-one error in the imapd annotate extension, an off-by-one error in cached header handling, a stack-based buffer overflow in fetchnews, or a stack-based buffer overflow in imapd.
An unknown vulnerability in the Microsoft Jet database engine (msjet40.dll) version 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted .mdb file.
Multiple SQL injection vulnerabilities in index.php of InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the idp, id_ctg, or id_man parameters.
Vulnerability in Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 with Active Directory allows local users to bypass group policies restricting access to hidden drives. The attack can be performed using the browse feature in Office 10 applications such as Word or Excel, or by using a flash drive.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script version 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. It was later reported that version 2.4 is also affected.
Multiple SQL injection vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to execute arbitrary SQL commands via liste or desc parameters in divers.php, the search text area, post name in post creation, profile fields (City, Homepage, ICQ, AOL, Yahoo!, MSN, e-mail), and the new field in the moderator section.
Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through 0.10.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
A PHP remote file inclusion vulnerability in modules.php of eXPerience2 allows remote attackers to execute arbitrary PHP code by modifying the 'file' parameter to reference a URL on a remote web server containing the code.
A format string vulnerability in Xpand Rally version 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
A format string vulnerability in IDA Pro 4.7.0.830 allows remote or local attackers to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a DLL name.
Buffer overflow vulnerability in HTTPMail component in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the username or password fields in logIn.asp, or the intAuctionID parameter in item.asp.
MetaCart 2.0 for Paypal contains multiple SQL injection vulnerabilities in parameters: intProdID in product.asp, intCatalogID and strSubCatalogID in productsByCategory.asp, and chkText, strText, chkPrice, intPrice, chkCat, strCat in searchAction.asp. These allow remote attackers to execute arbitrary SQL commands.
Unknown vulnerability in Webmin and Usermin before version 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
The vulnerability in FreeBSD 5.x through 5.4 on AMD64 involves improper initialization of the IO permission bitmap used to control user access to certain hardware. A local user can exploit this flaw to bypass intended access restrictions, potentially leading to denial of service, sensitive information disclosure, or privilege escalation.