CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via crafted JavaScript code.
The vulnerability in the EvalInSandbox function in Mozilla Firefox and Thunderbird before version 1.5.0.4 allows a remote attacker to gain elevated privileges via JavaScript that calls the valueOf method on objects created outside the sandbox.
A vulnerability in Mozilla Firefox and Thunderbird before version 1.5.0.4 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code through multiple vectors, such as nested <option> tags in a select tag, a DOMNodeRemoved mutation event, content-implemented tree views, BoxObjects, the XBL implementation, and an iframe attempting to remove itself, leading to memory corruption.
An integer overflow in Mozilla Firefox and Thunderbird before version 1.5.0.4 in the 'jsstr tagify' function allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code through memory corruption.
An unspecified vulnerability in Mozilla Firefox before version 1.5.0.4 and SeaMonkey before version 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context.
A vulnerability in Mozilla Firefox and Thunderbird before version 1.5.0.4 allows a remote attacker to execute code with higher privileges than intended by exploiting privileged UI code calling content-defined setters on an object prototype.
In Mozilla Firefox and Thunderbird before version 1.5.0.4, XUL attributes are incorrectly associated with the wrong URL under certain unspecified circumstances. This could allow a remote attacker to bypass restrictions by causing a persisted string to be associated with the wrong URL.
SQL injection vulnerability in modules.php in 4nNukeWare 4nForum 0.91 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows attackers to execute arbitrary SQL commands via crafted multibyte encodings (SJIS, BIG5, GBK) that are not properly handled by the mysql_real_escape function.
SQL injection vulnerability in Your_Account.asp in Mini-Nuke 2.3 and earlier. Remote attackers can execute arbitrary SQL commands via the yas_1, yas_2, and yas_3 parameters.
Multiple SQL injection vulnerabilities in Enigma Haber 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the id, hid, e, yid, bid, kid, tur, s, and id parameters in various scripts.
In home/register.php in Eggblog before version 3.0, a vulnerability allows remote attackers to change the password of administrators and possibly other users by modifying the username parameter.
SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the count and from variables in database.mysql.inc, database.pgsql.inc, and database.mysqli.inc.
In Nukedit 4.9.6 and earlier, the file utilities/register.asp allows remote attackers to create new users in arbitrary groups, including the administrative group, by modifying the groupid parameter during the addDB action.
A stack-based buffer overflow in ZipCentral 4.01 allows remote attackers to execute arbitrary code via a ZIP archive with a long filename, requiring user interaction.
The vulnerability in Open-Xchange 0.8.2 and earlier versions uses a static default username and password with a valid login shell in the LDAP server initfile. This allows remote attackers to access any server where the default credentials have not been changed.
A remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows attackers to include arbitrary files from external servers via the config[fsBase] parameter in multiple scripts.
PHP remote file inclusion vulnerability in p-popupgallery.php in F@cile Interactive Web 0.8.41 through 0.8.5. An attacker can execute arbitrary PHP code by sending a crafted URL in the l parameter.
SQL injection vulnerability in view_album.php in SelectaPix 1.4 allows remote attackers to execute arbitrary SQL commands via unknown vectors. The provenance of this information is unknown; details are obtained solely from third party sources.
SQL injection vulnerability in news.php of VARIOMAT allows remote attackers to execute arbitrary SQL commands via the subcat parameter.