CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the getwbbuserdata function in session.php in Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbitrary SQL commands via the userid or lastvisit cookie parameters.
A PHP remote file inclusion vulnerability in modules.php of eXPerience2 allows remote attackers to execute arbitrary PHP code by modifying the 'file' parameter to reference a URL on a remote web server containing the code.
Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through 0.10.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.
Vulnerability in Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 with Active Directory allows local users to bypass group policies restricting access to hidden drives. The attack can be performed using the browse feature in Office 10 applications such as Word or Excel, or by using a flash drive.
A stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet containing a long OCTET-STRING in the Trap variable-bindings field.
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Vulnerability in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in command line arguments.
The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
MetaCart 2.0 for PayFlow contains multiple SQL injection vulnerabilities in parameters passed to productsByCategory.asp and product.asp scripts. They allow a remote attacker to execute arbitrary SQL commands on the database.
A buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
A logic error in the CRAM-MD5 code of the UW-IMAP server, when CRAM-MD5 is enabled, does not properly enforce all required conditions for successful authentication, allowing remote attackers to authenticate as arbitrary users.
Format string vulnerability in the chdev tool in IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
A vulnerability in ReviewPost PHP Pro before version 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, bypassing intended restrictions.
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
A buffer overflow vulnerability in McAfee Scan Engine 4320 with DAT version prior to 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field. This is a variant of CVE-2005-0643.
Buffer overflow vulnerability in HTTPMail component in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code via a long packet to UDP port 41524, which is not properly handled in a recvfrom call.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS