CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in admincore.php in BirdBlog before version 1.2.0. A remote attacker can execute arbitrary SQL commands via the userid or userpw parameters.
Directory traversal vulnerability in auxpage.php in phpCoin 1.2.1b and earlier allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the page parameter.
Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the iChannel, iData, iCat, DAT_PARENT, and iRate parameters in various ASP scripts.
The vulnerability in ncpfs before version 2.2.6 is that the nwclient.c file does not drop root privileges before executing utilities using the NetWare client functions. This allows local users to escalate their privileges.
SQL injection vulnerability in PHP scripts of phpMyFamily 1.4.0 allows remote attackers to execute arbitrary SQL commands via the person parameter in people.php or the Login field.
Multiple SQL injection vulnerabilities were found in Valdersoft Shopping Cart 3.0. An attacker can remotely execute arbitrary SQL commands by manipulating parameters in various PHP scripts.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.
Vulnerability in Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 with Active Directory allows local users to bypass group policies restricting access to hidden drives. The attack can be performed using the browse feature in Office 10 applications such as Word or Excel, or by using a flash drive.
A vulnerability in Dnsmasq before version 2.21 allows remote attackers to poison the DNS cache by sending answers to queries that were not made by Dnsmasq.
A format string vulnerability in IDA Pro 4.7.0.830 allows remote or local attackers to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a DLL name.
A format string vulnerability in Xpand Rally version 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
A vulnerability in Firefox, Mozilla Suite, and Netscape browsers allows remote attackers to execute arbitrary code by adding a new search plugin using sidebar.addSearchEngine. The issue is fixed in Firefox 1.0.3, Mozilla Suite 1.7.7, and Netscape 7.2.
Buffer overflow vulnerability in discdb.c of grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected.
The custom avatar uploading feature (uploader.php) in XOOPS 2.0.9.2 and earlier does not filter file extensions, allowing remote attackers to upload arbitrary PHP scripts.
The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by sniffing the connection on TCP port 51100 and replaying the authentication information or obtaining and replaying the PCZQX02 authentication cookie from the browser.
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
Unknown vulnerability in Webmin and Usermin before version 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
Belkin 54G (F5D7130) wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication.
Buffer overflow in command.C in rxvt-unicode before version 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences.