CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Format string vulnerability in ProZilla 1.3.7.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the Location header.
Buffer overflow in Bontago 1.1 and earlier allows remote attackers to execute arbitrary code via a long nickname.
Stack-based buffer overflow in Knox Arkeia Server Backup 5.3.x allows remote attackers to execute arbitrary code via a long type 77 request.
SQL injection vulnerability in PerlDesk 1.x allows remote attackers to inject arbitrary SQL commands via the view parameter.
A vulnerability in AWStats 6.3 and 6.4 allows a remote attacker to execute Perl code via the PluginMode parameter in the awstats.pl script.
The diatheke.pl script in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
A heap-based buffer overflow in multiple F-Secure Anti-Virus and Internet Security products allows remote attackers to execute arbitrary code via a crafted ARJ archive.
PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.
Multiple buffer overflows in Cain & Abel before version 2.67 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via (1) an IKE packet with a large ID field that is not properly handled by the PSK sniffer filter, (2) the HTTP sniffer filter, or the (3) POP3, (4) SMTP, (5) IMAP, (6) NNTP, or (7) TDS sniffer filters.
SQL injection vulnerability in NotifyLink before version 3.0 allows remote attackers to execute arbitrary SQL commands via the URL.
The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument.
Buffer overflow vulnerability in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.
A vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via text strings that are not null terminated, which triggers a null dereference.
PHP remote file inclusion vulnerability in content.php and index.php of Vortex Portal allows remote attackers to execute arbitrary PHP code via a URL in the act parameter.
Vulnerability in AS/400 Telnet 5250 terminal emulation clients (IBM Client Access, Bosanova, PowerTerm, Mochasoft, and others) allows malicious AS/400 servers to execute arbitrary commands on the client workstation. The attack uses a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC Command), e.g., to create a backdoor account via REXEC.
A buffer overflow vulnerability in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, also known as the 'URL Parsing Memory Corruption Vulnerability.'
SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.
Vulnerability in Postfix 2.1.3 allows a remote attacker to bypass email restrictions and perform mail relaying by sending mail to an IPv6 hostname when /proc/net/if_inet6 is not available and permit_mx_backup is enabled in smtpd_recipient_restrictions.
Vulnerability in FlatNuke 2.5.1 allows a remote attacker to create an administrator account by injecting carriage returns and #10 characters in the url_avatar field in index.php, which are interpreted as a sensitive directive.
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 use weak encryption in the users.cfg, settings.cfg, users.dat, and user.dat files, allowing local users to extract passwords.