CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
TeeKai Forum version 1.2 allows remote attackers to authenticate as the administrator by setting the valid_level cookie to admin, granting access to privileged forum areas.
Buffer overflow in Fake Identd versions 0.9 through 1.4 allows remote attackers to execute arbitrary code as root via a long request that is split into multiple packets.
Buffer overflow in gdam123 versions 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.
BestCrypt BCWipe versions 1.0.7 and 2.0 through 2.35.1 do not clear alternate data streams on NTFS file systems, allowing attackers to recover sensitive information that was supposed to be deleted.
The default configuration of the Windows binary release of MySQL from 3.23.2 to 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database.
PGP versions 6.x and 7.x do not clear alternate data streams on NTFS file systems, allowing attackers to recover sensitive information that was supposed to be deleted.
Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request.
Buffer overflow in the IRC module of Trillian 0.725 and 0.73 allows remote attackers to execute arbitrary code via a long DCC Chat message.
Buffer overflow in axspawn.c in Axspawn-pam before version 0.2.1a allows remote attackers to execute arbitrary code via large packets.
Nagios versions 1.0b1 through 1.0b3 allow remote attackers to execute arbitrary commands via shell metacharacters in plugin output.
Buffer overflow in libc in Compaq Tru64 4.0F, 5.0, 5.1, and 5.1A allows attackers to execute arbitrary code via long (1) LANG and (2) LOCPATH environment variables.
NewsPro version 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to 'logged,true'.
The user_profile.asp file in PortalApp version 2.2 allows local users to gain elevated privileges by modifying the user_id variable.
A signed integer overflow in the bttv_read function in the bttv driver in Linux kernel before 2.4.20 has unknown impact and attack vectors.
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
The graph.php file in Ganglia PHP RRD Web Client version 1.0.2 has a vulnerability that allows remote attackers to execute arbitrary commands via the command parameter passed to the passthru function.
SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.
Multiple SQL injection vulnerabilities in PHProjekt versions 2.0 through 3.1 allow remote attackers to execute arbitrary SQL commands via unknown attack vectors.
The secure_inc.php file in PhotoDB 1.4 has a vulnerability that allows remote attackers to bypass authentication via a specially crafted URL with a large Time parameter and non-empty rmtusername and rmtpassword parameters, along with an accesslevel parameter lower than the required access level for the requested page.