CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in yaSSL before version 1.0.6, related to certificate chain processing. The impact and attack vectors are unknown.
The UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 does not allow users to disable access to SNMP or the rlogin port TCP 513, enabling remote attackers to exploit other vulnerabilities or execute arbitrary shell commands via rlogin without authentication.
The SNMP daemon in UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 has hard-coded public credentials that cannot be changed, which allows attackers to obtain sensitive information.
The telnet daemon in UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 has a default username "target" and password "password", which allows remote attackers to gain full access to the system.
Hitachi IP5000 VOIP WIFI Phone version 1.5.6 does not allow the user to disable access to SNMP or TCP port 3390. A remote attacker can exploit this to modify configuration (CVE-2005-3722) or access the Unidata Shell to obtain sensitive information or cause a denial of service.
The SNMP v1/v2c daemon in Hitachi IP5000 VOIP WIFI Phone 1.5.6 allows remote attackers to gain read or write access to system configuration using arbitrary SNMP credentials.
Unspecified vulnerability in the administration interface of Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in index.php.
SQL injection vulnerability in Arki-DB 1.0 and 2.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a view action (view.php) to index.php.
A buffer overflow in the environment variable substitution code in main.c in OSH 1.7-14 allows local users to inject arbitrary environment variables, such as LD_PRELOAD, via pathname arguments of the form "$VAR/EVAR=arg", which cause the EVAR portion to be appended to a buffer returned by a getenv function call.
A vulnerability in centericq 4.20.0-r3 with peer-to-peer communications enabled allows remote attackers to cause a segmentation fault and crash by sending short zero-length packets, and possibly packets of length 1 or 2, as demonstrated using Nessus.
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before version 1.5.3 Patch 4 allows remote attackers to execute arbitrary SQL commands via the DateFrom or DateUntil parameters to forum.php.
The AxWebRemoveCtrl ActiveX control for uninstalling the SunnComm MediaMax DRM allows remote attackers to download and execute arbitrary code, a similar vulnerability to CVE-2005-3650.
Multiple buffer overflows in freeFTPd 1.0.8, without logging enabled, allow remote authenticated attackers to cause a denial of service (application crash), and possibly execute arbitrary code, via long (1) MKD and (2) DELE commands.
A stack-based buffer overflow in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to execute arbitrary code via a long mailbox name in the select, create, delete, rename, subscribe, or unsubscribe commands.
In freeFTPd before version 1.0.9 with Logging enabled, a stack-based buffer overflow exists. A remote attacker can use a long USER command to cause a denial of service (application crash) and potentially execute arbitrary code.
The Transmission Control Protocol (TCP) allows remote attackers to cause a denial of service (bandwidth consumption) by sending ACK messages for packets that have not yet been received (optimistic ACKs), which can cause the sender to increase its transmission rate until it fills available bandwidth.
Multiple SQL injection vulnerabilities in Wizz Forum 1.20 allow remote attackers to execute arbitrary SQL commands via the AuthID parameter in ForumAuthDetails.php, and the TopicID parameter in ForumTopicDetails.php and ForumReply.php.
SQL injection vulnerability in the WF-Downloads module 2.05 for XOOPS allows remote attackers to execute arbitrary SQL commands via the 'list' parameter in viewcat.php.
Buffer overflow in RealNetworks RealPlayer 10 and 10.5 allows remote attackers to execute arbitrary code via a crafted image in a RealPlayer Skin (RJS) file.
SQL injection vulnerability in download.php of PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the file parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS