CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.
Buffer overflow vulnerability in Ability Server versions 2.25, 2.32, 2.34, and possibly others, allows remote attackers to execute arbitrary code via a long APPE command.
Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, allowing local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).
SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages with malformed quoting in MIME headers, parameters, and values.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use whitespace in an unusual fashion, which may be interpreted differently by mail clients.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use multiple MIME fields with the same name, which may be interpreted differently by mail clients.
A vulnerability in libpng version 1.2.5 and earlier results from improper calculation of buffer offsets. A remote attacker can exploit this flaw to cause a buffer overflow and execute arbitrary code.
Multiple buffer overflows in Gaim before version 0.82 allow remote attackers to cause a denial of service and possibly execute arbitrary code via RTF messages, a long hostname from DNS, or a long URL mishandled by the URL decoder.
Buffer overflow vulnerability in the _maincfgret.cgi script in Ipswitch WhatsUp Gold before version 8.03 Hotfix 1. A remote attacker can exploit a long instancename parameter to execute arbitrary code.
A stack-based buffer overflow in the xpm_extract_color function (io-xpm.c) of the XPM image decoder in gtk+ 2.4.4 and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a crafted color string.
Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
The calendar program in bsdmainutils versions 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, allowing attackers to execute arbitrary commands via a calendar event file.
Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.
In redhat-config-nfs before version 1.0.13, an unknown vulnerability when shares are exported to multiple hosts can cause incorrect permissions and prevent the all_squash option from being applied.
A buffer overflow vulnerability in WIDCOMM Bluetooth Connectivity Software, used in products such as BTStackServer 1.3.2.7 and 1.4.2.10, Windows XP and Windows 98 with MSI Bluetooth Dongles, and HP IPAQ 5450 running WinCE 3.0, allows remote attackers to execute arbitrary code via specially crafted service requests.
Vulnerability in DB2 8.1 allows local users to escalate privileges via the remote command server (DB2RCMD.EXE), which executes the db2rcmdc.exe program as the db2admin administrator. Attackers can exploit the DB2REMOTECMD named pipe to gain control.
A format string vulnerability in the auth_debug function in Courier-IMAP versions 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.
An integer overflow in Gaim before version 0.82 in the size variable of Groupware server messages allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Multiple stack-based buffer overflows were found in libXpm before version 6.8.1 in functions xpmParseColors, ParseAndPutPixels, and ParsePixels. A remote attacker can exploit a specially crafted XPM image file to execute arbitrary code.