CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The rdiff and preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, allowing remote attackers to read restricted areas and access restricted content in TWiki topics.
An unspecified vulnerability in the swagentd service on HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
An unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors.
Trend Micro OfficeScan 5.5 and probably earlier versions before 6.5 use insecure DACLs for critical files. A local user can modify tmlisten.exe, allowing privilege escalation to SYSTEM.
A remote file inclusion vulnerability in the ImpEx module for vBulletin (version 1.74) allows attackers to include arbitrary files via the systempath parameter in ImpExData.php. This issue occurs even when register_globals is disabled.
Trend Micro PC-cillin Internet Security 2006 versions 14.00.1485 and 14.10.0.1023 use insecure DACLs for critical files, allowing local users to gain SYSTEM privileges by modifying executable programs such as tmntsrv.exe and tmproxy.exe.
The vulnerability in Trend Micro InterScan Messaging Security Suite (IMSS) 5.5 build 1183 and earlier versions before 5.7.0.1121 involves insecure DACLs for critical files in the ISNTSmtp directory. A local user can exploit this weakness by modifying the ISNTSysMonitor.exe file, leading to SYSTEM privileges.
SQL injection vulnerability in viewStatement.php of AdMan version 1.0.20051221 and earlier. Remote attackers can execute arbitrary SQL commands via the transactions_offset parameter.
A vulnerability in eXpandable Home Page (XHP) CMS version 0.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP files via the HTMLArea FileManager plugin. The flaw exists in manager.php, standalonemanager.php, and images.php.
A buffer overflow vulnerability exists in the swfformat.dll library in multiple RealNetworks products (RealPlayer 10.x, RealOne Player, Rhapsody 3, Helix Player) when processing crafted SWF (Flash) files. An attacker can exploit this to execute arbitrary code remotely via a SWF file with an incorrect size or other manipulations.
A buffer overflow in the USB Gadget RNDIS implementation in the Linux kernel before version 2.6.16 allows remote attackers to cause a denial of service (kmalloc'd memory corruption) by sending a remote NDIS response to OID_GEN_SUPPORTED_LIST, which allocates memory for the reply data but not the reply structure.
A buffer overflow vulnerability exists in RealNetworks RealPlayer when processing malicious Mimio boardCast (mbc) files. It affects multiple versions prior to the March 22, 2006 update.
A buffer overflow vulnerability in Motorola PEBL U6 (version 08.83.76R) and other P2K-based phones allows remote attackers to cause a denial of service (device shutdown) and possibly execute arbitrary code via a long OBEX setpath request to the OBEX File Transfer (FTP) service on Bluetooth channel 9.
Vulnerability in the opiepasswd tool in OPIE (One-Time Passwords in Everything) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322. The getlogin function is used to determine the invoking user account, which may allow local users to configure OPIE access to the root account and possibly gain root privileges if the wheel group or sshd configuration permits.
Multiple SQL injection vulnerabilities were found in MusicBox 2.3 Beta 2. Remote attackers can execute arbitrary SQL commands via the id, type, show parameters in index.php and message1, message parameters in cart.php.
In FreeWPS 2.11, the images.php script contains a vulnerability allowing remote execution of arbitrary PHP code. An attacker can upload a .php file to the /upload directory and then directly request that file.
Microsoft w3wp.exe does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET. A remote attacker can repeatedly request documents that refer to COM components or restricted documents under the ASP.NET application path, causing resource exhaustion or crash.
Mini-Nuke CMS System 1.8.2 and earlier contains multiple SQL injection vulnerabilities in the uid, catid, and id parameters across various ASP scripts. This allows a remote attacker to execute arbitrary SQL commands.
A programming error in the fast_ipsec component in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 improperly updates the sequence number associated with a Security Association. This allows remote attackers to capture IPSec packets and conduct replay attacks.
A vulnerability in Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and potentially execute arbitrary code via a crafted createTextRange call on a checkbox object, resulting in a dereference of an invalid table pointer.