CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2003-0257 describes a format string vulnerability in the printer capability for IBM AIX versions 3, 5.1, and 5.2, allowing local users to gain printq or root privileges.
SAP R/3 versions from 2.0B to 4.6D installs several clients with default users and passwords, allowing remote attackers to gain privileges via accounts such as SAP*, SAPCPIC, DDIC, EARLYWATCH, or TMSADM.
Vulnerability in ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass email protection via attachments whose names contain certain non-English characters.
SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.
SQL injection vulnerability in auth.php and admin.php files of PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account by sending base64-encoded SQL in the admin parameter.
Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode and offset parameters in many PHP scripts.
The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL.
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the Theme, Country, Real Name, or Displayed time zone fields in a User Profile, or the Name, Description, URL, or Country fields in a Directory/Add Site operation.
X-Micro WLAN 11b Broadband Router versions 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 contain a hardcoded administrative account named "super" with a default password. This allows a remote attacker to gain full access to the device without authorization.
The X-Micro WLAN 11b Broadband Router version 1.6.0.1 contains hardcoded credentials: username and password "1502". This allows remote attackers to gain access to the device.
Multiple buffer overflows in LCDProc 0.4.1 and possibly other 0.4.x versions up to 0.4.4 allow remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function, or (2) long argv command to test_func_func function.
A format string vulnerability in the test_func_func function in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.
A buffer overflow vulnerability in the parse_all_client_messages function in LCDproc versions 0.4.x through 0.4.4 allows remote attackers to execute arbitrary code by sending a large number of arguments.
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 and 10 allow remote attackers to inject arbitrary web script or HTML via parameters such as email, file, dns, account, db, login, or ip in URLs.
Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to steal users' passwords by manipulating parameters in various scripts.
Directory Services in Apple Mac OS X versions 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server versions 10.2 through 10.3.2 accept authentication server information from unknown LDAP or NetInfo sources, which can be exploited by a malicious DHCP server.
Apple Mac OS X versions 10.0 through 10.2.8 allow local users with a USB keyboard to gain unauthorized access. This can be achieved by holding down the CTRL and C keys during system boot, which crashes the init process and leaves the user in a root shell.
Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.
An unknown vulnerability in rpc.mountd on SGI IRIX versions 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.
Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.