CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Mozilla Firefox, Thunderbird, Mozilla Suite, and SeaMonkey allows remote attackers to execute arbitrary code via an invalid and nonsensical ordering of table-related tags, resulting in a negative array index.
The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 contains a buffer overflow vulnerability. Remote attackers can cause a denial of service (crash) and possibly execute arbitrary code via crafted Cascading Style Sheets (CSS) that trigger an out-of-bounds array write.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
A stack-based buffer overflow in Novell GroupWise Messenger before version 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property, leading to a heap-based buffer overflow.
An eval injection vulnerability in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the $method and $args parameters in pajax_call_dispatcher.php.
Adobe Document Server for Reader Extensions 6.0 lacks proper access control, allowing remote authenticated users to perform privileged actions by modifying the actionID and pageID parameters.
Multiple SQL injection vulnerabilities in Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the blogid, m, y, and sql parameters.
A directory traversal vulnerability in the pbcs.dll component of SAXoTECH SAXoPRESS (formerly Publicus) allows remote attackers to read arbitrary files and potentially execute arbitrary programs by using '..' sequences in the url parameter.
PHP remote file inclusion vulnerability in doc/index.php in Simplog 0.9.2 and earlier. Remote attackers can execute arbitrary PHP code by supplying a crafted URL in the 's' parameter.
A directory traversal vulnerability in doc/index.php in Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter. The attack can be performed by injecting PHP code into the Apache error_log file, which is then included by doc/index.php.
Multiple PHP remote file inclusion vulnerabilities in AzDGVote allow an attacker to execute arbitrary PHP code by supplying a URL in the int_path parameter. The affected files are vote.php, view.php, admin.php, and admin/index.php.
In Debian GNU/Linux, during the configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, debconf uses the world-readable config.dat file instead of the restricted passwords.dat file to store the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, allowing local users to view the password.
A vulnerability in HP System Management Homepage (SMH) 2.1.3.132 running on CompaqHTTPServer/9.9 (Windows, Linux, Tru64 UNIX) allows remote attackers to bypass authentication via a crafted URL when 'Trust by Certificates' is not enabled.
A PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the root_path parameter. This issue also affects versions 1.4.2 and earlier.
INDEXU 5.0.0 and 5.0.1 contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the theme_path parameter in 25 scripts and the base_path parameter in invoice.php to execute arbitrary PHP code.
A directory traversal vulnerability exists in index.php of blur6ex 0.3.452 via the 'shard' parameter, allowing remote attackers to include arbitrary files. This can also lead to XSS and path disclosure.
Hosting Controller 6.1 stores the file forum/db/forum.mdb under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information such as usernames and passwords.