CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
The SURECOM EP-4501 broadband router uses a default SNMP read community string of 'public' and a default SNMP read/write community string of 'secret,' allowing remote attackers to read and modify router configuration information.
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
f2html.pl versions 0.1 through 0.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via file names.
VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges.
Netgear FM114P firmware version 1.3 allows remote attackers to cause a denial of service (crash or hang) by sending a large number of TCP connection requests.
VelociRaptor 1.0 has a memory leak in the httpd, nntpd, and VPN driver components, allowing remote attackers to cause a denial of service through memory consumption.
The ping utility in networking_utils.php in Sourcecraft Networking_Utils 1.0 allows remote attackers to read arbitrary files via shell metacharacters in the Domain name or IP address argument.
The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, allowing remote attackers to access the file system as root.
The administration web page for Iomega NAS A300U transmits passwords in cleartext, allowing remote attackers to sniff the administrative password.
PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to backend.php, screen.php, or admin/modules/comment.php.
Linksys WET11 firmware versions 1.31 and 1.32 allow remote attackers to cause a denial of service (crash) by sending a packet with the device's hardware address as the source MAC address in the DLC header.
Buffer overflow in Advanced TFTP (atftp) versions 0.5 and 0.6, if installed with setuid or setgid, may allow local users to execute arbitrary code via a long argument to the -g option.
Unspecified vulnerability in the bind function in config.inc of aldap 0.09 allows remote attackers to authenticate with Manager permissions.
Symantec Norton Personal Firewall 2002 allows remote attackers to bypass portscan protection by using various combinations of TCP flags, such as SYN/FIN, SYN/FIN/URG, SYN/FIN/PUSH, and SYN/FIN/URG/PUSH.
SQL injection vulnerability in agentadmin.php in Immobilier allows remote attackers to execute arbitrary SQL commands via the (1) agentname or (2) agentpassword parameter.
MySimpleNews 1.0 allows remote attackers to delete arbitrary email messages via a direct request to vider.php3.
Buffer overflow in the IDENT daemon (identd) in Trillian 0.6351, 0.725, 0.73, 0.74 and 1.0 pro allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long request.
Sun PC NetLink versions 1.0 through 1.2 improperly set access control lists (ACL) for files and directories using symbolic links that have been restored from backup. This could allow local or remote attackers to bypass intended access restrictions.
ICQ client versions 2001b, 2002a, and 2002b allow remote attackers to cause a denial of service by sending a message with a large number of emoticons.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS