CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the crn parameter in a show action or rn parameter in a show_detail action.
Multiple vulnerabilities in fliccd, installed setuid root as part of the kdeedu Kstars support for INDI in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
A buffer overflow vulnerability in McAfee Scan Engine 4320 with DAT version prior to 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field. This is a variant of CVE-2005-0643.
Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code via a long packet to UDP port 41524, which is not properly handled in a recvfrom call.
Format string vulnerability in the chdev tool in IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
The S/MIME plugin 0.4 and 0.5 for Squirrelmail contains a vulnerability in viewcert.php that allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the cert parameter.
A buffer overflow vulnerability in the ipl_varyon tool on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument.
Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the language parameter to register.php, change email feature in profile.php, posts or topics parameter to moderate.php.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.
A vulnerability in pafiledb.php in Pafiledb 3.1 allows remote attackers to execute arbitrary PHP code via a modified action parameter used in an include statement for login.php.
The vulnerability in ncpfs before version 2.2.6 is that the nwclient.c file does not drop root privileges before executing utilities using the NetWare client functions. This allows local users to escalate their privileges.
Buffer overflow in Stormy Studios Knet 1.04c and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP GET request.
Vulnerability in comersus_backoffice_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain unauthorized privileges via a direct request to the file.
Vulnerability in Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 with Active Directory allows local users to bypass group policies restricting access to hidden drives. The attack can be performed using the browse feature in Office 10 applications such as Word or Excel, or by using a flash drive.
CRLF injection vulnerability in users.php in Siteman 1.1.10 and earlier allows remote attackers to add arbitrary users and gain privileges via the line parameter in a docreate operation.
The vulnerability in the Solaris Management Console (SMC) GUI for Solaris 8 and 9 causes user accounts configured for password aging to be created with a blank password, allowing remote or local attackers to break into those accounts.
Buffer overflow vulnerability in netpmon on AIX 5.1, 5.2, and 5.3. A local user can exploit a long -O argument to execute arbitrary code.
SQL injection vulnerability in ad_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner_id parameter.
Vulnerability in WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to ajout_admin2.php or suppr.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS