CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in w3m before version 0.5.3-31 related to improper validation of tag attribute values, which can lead to heap buffer overflow and program crashes. Remote attackers may exploit this vulnerability to potentially execute arbitrary code via a crafted HTML page.
An issue was discovered in the w3m fork before version 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in w3m before version 0.5.3-31 related to the feed_table_tag function, which does not properly validate the table span value. This allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page.
An issue was discovered in phpMyAdmin that allows SQL injection via a crafted username or table name in the tracking functionality. The executed statements run with the privileges of the control user, granting access to configuration storage database tables and, if the control user has the necessary privileges, to some MySQL database tables.
An issue was discovered in phpMyAdmin that allows for a Denial of Service (DoS) attack through a very large request to the table partitioning function. All 4.6.x versions prior to 4.6.5 are affected.
An issue was discovered in phpMyAdmin that allows for BBCode injection on the login page via a crafted login request. All 4.6.x versions (prior to 4.6.5) are affected.
An issue was discovered in phpMyAdmin related to the limitation in URL matching, allowing for the bypass of URL white-list protection. This affects versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
An issue was discovered in phpMyAdmin that can lead to remote code execution in certain PHP installations running with the dbase extension. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
An issue was discovered in phpMyAdmin that allows for remote code execution when the application is run as CGI. A user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh.
An issue was discovered in phpMyAdmin allowing for SQL injection attacks through the user interface preference feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
An issue was discovered in phpMyAdmin that allows for an SQL injection attack through the export functionality by using a specially crafted database and/or table name. All 4.6.x versions prior to 4.6.4 are affected.
An issue was discovered in phpMyAdmin that allows for an SQL injection attack in the 'User group' and 'Designer' features. An attacker can exploit this vulnerability against the control user account. Affects versions 4.6.x (prior to 4.6.4) and 4.4.x (prior to 4.4.15.8).
An issue was discovered in phpMyAdmin that allows for an SQL injection attack through a specially crafted database and/or table name in the export functionality. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
An issue was discovered in phpMyAdmin that allows arbitrary PHP commands to be executed through a specially crafted database name in the array export feature. This affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack, allowing an attacker with access to a user's browser cookie file to decrypt these credentials.
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 may allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges through mishandling of special characters in database or role names.
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
Directory traversal vulnerability in the safer_name_suffix function in GNU tar versions 1.14 through 1.29 may allow remote attackers to bypass an intended protection mechanism and write to arbitrary files due to improper sanitization of the file_name parameter.
Django versions before 1.8.16, 1.9.11, and 1.10.3, when DEBUG is enabled, allow remote attackers to conduct DNS rebinding attacks due to failure to validate the HTTP Host header against ALLOWED_HOSTS.
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.