CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote attackers to execute arbitrary code via unspecified vectors.
A vulnerability in nfsd in the FreeBSD 6.0 kernel allows a remote attacker to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.
A directory traversal vulnerability was found in index.php in 4Images 1.7.1 and earlier. Attackers can read and include arbitrary files using ".." sequences in the template parameter.
An unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows attackers to cause a system panic (denial of service) or execute arbitrary code.
SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp. The vendor disputes the issue, claiming a complex state management system with JavaScript and server-side session state protects against SQL injection, and that errors may be due to invalid field values rather than actual injection.
Eval injection vulnerability in sessions.inc of PHP Base Library (PHPLib) before 7.4a. When index.php3 from the PHPLib distribution is available on the server, remote attackers can execute arbitrary PHP code by including a base64-encoded representation of the code in a cookie.
NOCC Webmail 1.0 stores email attachments in temporary files with predictable filenames, making it easier for remote attackers to execute arbitrary code by accessing the email attachment via directory traversal vulnerabilities.
The WYSIWYG rendering engine (rich mail editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass JavaScript security settings. By sending an email containing a JavaScript URI in the SRC attribute of an IFRAME tag, the code executes when the user edits the email, potentially leading to sensitive information disclosure or a crash.
Multiple PHP remote file include vulnerabilities exist in Noah's Classifieds 1.3 in gorum/gorumlib.php. When register_globals is enabled, an attacker can use the upperTemplate and lowerTemplate parameters to include arbitrary PHP files from remote sources.
SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.
Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before version 2.2 have unknown vectors and impact, addressed by 'Urgent secure fixes'. Note: this might be a duplicate of CVE-2006-0854, but the vendor announcement is too vague to confirm.
SQL injection vulnerability in login.php of Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.
Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to falsify authentication credentials.
The vulnerability in Global Hauri ViRobot 2.0 20050817 involves the filescan component not verifying the Cookie HTTP header. This allows a remote attacker to gain administrative privileges by sending an arbitrary cookie value.
Unquoted Windows search path vulnerability in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier. A local user can exploit a malicious "program" file placed in the C: folder to gain elevated privileges.
SQL injection vulnerability in pages.asp of Mini-Nuke CMS System version 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Later versions, including 2.3, are also reported as vulnerable.
A stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service or possibly execute arbitrary code via a crafted .m3u file when the player pauses or stops the file.
The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server versions 4.6.0.4, 4.6.1.1, and possibly others before 4.6.1.2 does not drop privileges before executing other programs, allowing local users to gain elevated privileges.
SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter when creating a new post.
Admbook 1.2.2 and earlier contains a direct static code injection vulnerability in write.php. A remote attacker can exploit the X-Forwarded-For HTTP header to inject and execute arbitrary PHP code, which is stored in content-data.php.