CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in subs.pl script in WebAPP versions 0.9.9 through 0.9.9.2. May allow attacks using shell metacharacters or '..' sequences.
A buffer overflow vulnerability in the slc_add_reply function in BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.
A buffer overflow vulnerability in the HTTP redirection functionality in conn.c of Axel before version 1.0b may allow remote attackers to execute arbitrary code.
Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.
In ZeroBoard 4.1pl5 and earlier, multiple PHP files (print_category.php, login.php, setup.php, ask_password.php, error.php) contain a remote file inclusion vulnerability. An attacker can modify the 'dir' parameter to point to a remote server containing malicious PHP code, enabling its execution.
Belkin 54G (F5D7130) wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication.
Buffer overflow in command.C in rxvt-unicode before version 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences.
SQL injection vulnerability in Subdreamer Light allows remote attackers to execute arbitrary SQL commands via parameters used as global variables when magic_quotes_gpc is enabled. The issue occurs in index.php, with the imageid parameter being a demonstrated attack vector not properly handled by imagegallery.php.
PHP remote file inclusion vulnerability in catalog.php of E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary PHP code by modifying the 'menu' and 'main' parameters to reference a URL on a remote server.
Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the EntryID or searchterm parameter to index.php, or username parameter to authenticate.php.
Vulnerability in ELOG before version 2.5.7 allows a remote attacker to bypass authentication and download a configuration file containing a sensitive write password via a modified URL.
An unknown vulnerability in the remoteping service in remstats 1.0.13 and earlier allows remote attackers to execute arbitrary commands due to missing input sanitization.
A buffer overflow vulnerability in the Sentinel LM (Lservnt) service in Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by sending a large amount of data to UDP port 5093.
The vulnerability in Barracuda Spam Firewall 3.1.10 and earlier allows members of whitelisted domains to send mail to any domain, enabling the device to be used as an open mail relay for spam.
Vulnerability in consoleConnect.jsp in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter.
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 on Mac OS X allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
Samsung ADSL Modem SMDK8947v1.2 uses default passwords for the root, admin, and user accounts, allowing remote attackers to gain privileges via Telnet or an HTTP request to adsl.cgi.
Multiple buffer overflows in DeleGate before version 8.11.1 may allow attackers to cause a denial of service or execute arbitrary code, possibly due to overflows on arrays.
SQL injection vulnerability in viewall.php and category.php of paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter in pafiledb.php.
Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to upload and potentially execute files outside the directory via the AttachmentsKey parameter to attachment.do, and delete arbitrary files via the select_file parameter to file.do.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS