CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.
An unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. The provenance of this information is unknown; details are obtained from third party reports.
The vulnerability in distcc 2.x, used in XCode 1.5 and others, allows remote attackers to execute arbitrary commands by sending compilation jobs, which are executed without authorization checks when the server is not configured to restrict access to the port.
SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) versions 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the 'table' and 'field' parameters in LinkClick.aspx.
Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.
Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.
Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted mount or sysfs system calls.
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.
Vulnerability in Windows XP Explorer allows attackers to execute arbitrary code via a specially crafted self-executing folder containing HTML and script that references an executable file within the same folder, which is automatically executed when a user accesses the folder.
Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the clientRcptTo array, and the Received and messageID variables, possibly involving HELO and hostname arguments.
The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before version 2.0 does not drop privileges when using the help functionality, allowing local users to gain privileges.
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
The SSL HTTP Server in HP Web-enabled Management Software versions 5.0 through 5.92, with anonymous access enabled, allows remote attackers to compromise trusted certificates by uploading their own certificates.
Unknown vulnerability in Sysbotz SimpleData 4.0.1 and possibly earlier versions allows remote attackers to gain access via a crafted URL and a certain cookie.
The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default login text for the management interface, which allows remote attackers to gain access.
A stack-based buffer overflow vulnerability in the swnet.dll library in YaSoft Switch Off 2.3 and earlier allows remote authenticated users to execute arbitrary code by sending a long message parameter in a SendMsg action to action.htm.
Directory traversal vulnerability in Net2Soft Flash FTP Server 1.0 allows remote attackers to read and create arbitrary files via a /.. (slash dot dot) sequence.
SQL injection vulnerability in the Reviews module of PHP-Nuke versions 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Unrestricted file upload vulnerability in AspDotNetStorefront 3.3 allows remote authenticated administrators to upload arbitrary files with executable extensions via admin/images.aspx.
SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin versions 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter.