CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the glob or expand commands of a foldexpr expression for calculating fold levels.
The vulnerability in Oray PeanutHull 3.0.1.0 and earlier versions is due to improper dropping of SYSTEM privileges when launched from the system tray. This allows a local user to escalate privileges by accessing the Help functionality.
A buffer overflow vulnerability in SlimFTPd versions 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name in LIST, DELE, or RNFR commands.
Multiple integer signedness errors in libgadu, as used in ekg before 1.6rc2 and other packages, may allow remote attackers to cause a denial of service or execute arbitrary code.
The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes hidden devices available to attackers, who can then bypass restrictions on a jailed process.
Vulnerability in Y.SAK CGI scripts (w_s3mbfm.cgi, w_s3adix.cgi, w_s3sbfm.cgi) allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the $no variable.
A buffer overflow vulnerability in Winamp before version 5.094 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3v2 tag such as ARTIST or TITLE.
PHP remote file inclusion vulnerability in CaLogic 1.2.2 allows remote attackers to execute arbitrary code via the CLPATH parameter to (1) cl_minical.php, (2) clmcpreload.php, (3) mcconfig.php, or (4) mcpi-demo.php.
A vulnerability in a contributed script for the ekg Gadu Gadu client version 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
Vulnerability in inc.login.php in PHPsFTPd versions 0.2 through 0.4 allows a remote attacker to bypass the login mechanism and obtain the administrator's username and password by setting the do_login parameter and performing an edit action using user.php, which causes the password to leak in the response.
DG Remote Control Server 1.6.2 is vulnerable to a denial of service (crash or high CPU consumption) and possible arbitrary code execution via a long message sent to TCP port 1071 or 1073, likely due to a buffer overflow.
The vulnerability in management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id parameter.
Vulnerability in Shorewall versions 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via certain crafted JPEG images, as demonstrated using (1) mov_fencepost.jpg, (2) cmp_fencepost.jpg, (3) oom_dos.jpg, or (4) random.jpg.
A vulnerability in WebCalendar before version 1.0.0 allows remote attackers to gain unauthorized privileges due to insufficient access restrictions on the assistant_edit.php script.
Multiple SQL injection vulnerabilities were found in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed. An attacker can modify SQL statements via the id parameter in viewattach.php, viewuser_id parameter in users.php, or the id or forum parameter in viewforum.php.
A vulnerability in Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.
Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.
WebEOC before version 6.0.2 does not properly check user authorization, allowing remote attackers to gain privileges via a direct request to a resource.