CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in member.php of PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.
Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter. In some cases, remote file inclusion via SMB share is possible under PHP 5.
Multiple SQL injection vulnerabilities in index.php of Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the start parameter in a search action or the type parameter in a top action.
SQL injection vulnerability in sql.php of phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.
Censtore 7.3.002 and earlier contain a vulnerability in censtore.cgi that allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the page parameter.
A directory traversal vulnerability in posts.php of SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie. The attack can be performed by injecting code into the gl_session cookie of users.php, which is stored in error.log.
SQL injection vulnerability in rateit.php of RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.
SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the $username variable in the mosGetParam function, the $task parameter in the mosMenuCheck function in includes/mambo.php, and the $filter variable in the showCategory function in the com_content component.
A directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter in class.forumposts.php and forumpollrenderer.php.
Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22. The flaw involves authentication exploits with unknown attack vectors and impact.
A directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. A failed include can also result in secondary XSS.
A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
An integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.
A vulnerability in nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a 'particular sequence of HTML tags' leading to memory corruption.
An unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox's ForEach method.
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.
An unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".
A vulnerability in Mozilla Firefox, Thunderbird, Mozilla Suite, and SeaMonkey allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create JavaScript functions compiled with extra privileges.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
A stack-based buffer overflow in Novell GroupWise Messenger before version 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.