CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 version 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.
Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.
Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username.
All three applications: AllMyVisitors, AllMyLinks, and AllMyGuests have a PHP remote file inclusion vulnerability in include/footer.inc.php. An attacker can execute arbitrary PHP code by exploiting the _AMVconfig[cfg_serverpath] parameter.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
AIM Sniff (aimSniff.pl) version 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log.
A stack-based buffer overflow in The Palace client version 3.5 and earlier allows remote attackers to execute arbitrary code via a link to a palace:// URL followed by a long server address string.
Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
Buffer overflow in the UdmDocToTextBuf function in mnoGoSearch versions 3.2.13 through 3.2.15 could allow remote attackers to execute arbitrary code by indexing a large document.
Buffer overflow vulnerability in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including version 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.
Load Sharing Facility (LSF) versions 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user. This could allow remote attackers within the local cluster to gain privileges.
SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
A stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.