CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before version 4.5.538.001 and ZoneLabs Integrity client before version 4.0.146.046 and 4.5 before version 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
The firmware of the Gigabyte Gn-B46B 2.4Ghz wireless broadband router version 1.003.00 allows local users on the same network to bypass authentication by using a copy of the router's HTML menu on a separate system.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.
An unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.
Multiple SQL injection vulnerabilities in YaBB SE versions 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via the msg and postid parameters in ModifyMessage.php.
SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.
PHPX versions 2.0 through 3.2.4 allows remote attackers to gain access to other accounts by modifying the cookie's PXL variable to reference another userID.
X-Cart version 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in upgrade.php and general.php.
Buffer overflow in the UdmDocToTextBuf function in mnoGoSearch versions 3.2.13 through 3.2.15 could allow remote attackers to execute arbitrary code by indexing a large document.
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
The vulnerability in viewtopic.php of phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
The vulnerability in Sophos Small Business Suite 1.00 on Windows involves improper handling of files whose names contain reserved MS-DOS device names such as LPT1, COM1, AUX, CON, or PRN. This allows malicious code to bypass detection when installed, copied, or executed.
Integer overflow vulnerability in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition. A remote attacker can exploit improper length validation in compressed (zipped) folders to execute arbitrary code.