CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WebEOC before version 6.0.2 does not properly check user authorization, allowing remote attackers to gain privileges via a direct request to a resource.
Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.
WebEOC before version 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.
In MailEnable Professional 1.54, a stack-based buffer overflow exists in the IMAP daemon (imapd). A remote authenticated user can exploit this by sending a status command with a long mailbox name, leading to arbitrary code execution.
Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.
SQL injection vulnerability in PhpAuction 2.5 allows remote attackers to modify SQL queries via the 'category' parameter in adsearch.php.
Multiple unknown vulnerabilities have been discovered in Jinzora 2.0.1, with unknown impact and attack vectors, possibly involving a PHP file inclusion vulnerability.
Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the sidebar using the _search target, then injecting script into other pages via a data: URL.
Vulnerability in Firefox, Thunderbird, Mozilla, Netscape, and K-Meleon browsers allows XBL scripts to run even when JavaScript is disabled. A remote attacker can exploit this flaw to bypass script protection.
Vulnerability in Firefox before version 1.0.5 allows remote attackers to steal information and potentially execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.
The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including USANet Shopping Mall Software, Domain Name Auction Software, Standard Classified Ads Software, and MakeBid Reverse Auction, allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.
The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.
Buffer overflow vulnerability in the Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.
The vulnerability in Firefox before version 1.0.5 and Mozilla before version 1.7.9 is due to improper cloning of base objects. A remote attacker can exploit the prototype chain to access a privileged object and execute arbitrary code.
PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.
Vulnerability in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 involves improper verification of DOM node name types within the context of their namespaces. This allows a remote attacker to modify tag properties, potentially leading to arbitrary script or code execution, as demonstrated using an XHTML document with IMG tags with custom properties.
PHP remote file inclusion vulnerability in photolist.inc.php in Squito Gallery 1.33 allows remote attackers to execute arbitrary code via the photoroot parameter.
The saveProfile function in PhpSlash 0.8.0 allows remote attackers to modify arbitrary profiles and gain privileges by modifying the author_id parameter.
PHP remote file inclusion vulnerability in secure.php in PHPSecurePages (phpSP) 0.28beta and earlier allows remote attackers to execute arbitrary code via the cfgProgDir parameter.
Softiacom wMailserver 1.0 stores passwords in plaintext in the Darsite\MAILSRV\Admin registry key, allowing local users to gain administrator privileges.