CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in the Sentinel LM (Lservnt) service in Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by sending a large amount of data to UDP port 5093.
An unknown vulnerability in the remoteping service in remstats 1.0.13 and earlier allows remote attackers to execute arbitrary commands due to missing input sanitization.
Vulnerability in ELOG before version 2.5.7 allows a remote attacker to bypass authentication and download a configuration file containing a sensitive write password via a modified URL.
Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the EntryID or searchterm parameter to index.php, or username parameter to authenticate.php.
Cisco devices running ACNS 4.x, 5.0, 5.1, or 5.2 use a default password when the setup dialog has not been run, allowing remote attackers to gain access.
A buffer overflow vulnerability in McAfee Scan Engine 4320 with DAT version prior to 4357 allows remote attackers to execute arbitrary code via crafted LHA files.
A heap-based buffer overflow in psd.c in ImageMagick versions 6.1.0, 6.1.7, and earlier allows remote attackers to execute arbitrary code via a specially crafted .PSD image file with a large number of layers.
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary code via format string specifiers in data that is passed directly to syslog.
A buffer overflow vulnerability in the ncplogin utility in ncpfs before version 2.2.6 allows a remote malicious NetWare server to execute arbitrary code on the NetWare client.
The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the href attribute, aka "Firelinking".
Multiple buffer overflows in Lotus Domino Server 6.0.5 and 6.5.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via large amounts of data in certain time or date fields.
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow remote attackers to execute arbitrary code via a modified computer name and length leading to a heap-based buffer overflow, or local users to execute arbitrary code via a long Name entry in the configure.cfg file.
Vulnerability in ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel. The attack is possible via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter.
Vulnerability in WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to ajout_admin2.php or suppr.php.
An unknown vulnerability in AIX 5.3.0 configured as an NIS client allows remote attackers to gain root privileges.
SQL injection vulnerability in PhotoPost PHP Pro 5.x allows remote attackers to execute arbitrary SQL commands via the 'sl' parameter in showmembers.php or the 'photo' parameter in showphoto.php.
PHP remote file inclusion vulnerability in index_header.php of EncapsBB 0.3.2_fixed (and possibly other versions) via the root parameter allows remote attackers to execute arbitrary PHP code.
PHPOpenChat 3.0.1 and earlier contain multiple PHP remote file inclusion vulnerabilities, allowing an attacker to execute arbitrary PHP code via the phpbb_root_path, poc_root_path, and sourcedir parameters.