CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The x-man-page: URI handler for Apple Terminal 1.4.4 in Mac OS X 10.3.9 does not cleanse terminal escape sequences, which allows remote attackers to execute arbitrary commands.
The BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which allows local users to gain privileges.
Buffer overflow in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier may allow local users to gain privileges via a long XAPPLRESLANGPATH or XAPPLRESDIR environment variable, or command line argument.
Open WebMail (OWM) before version 2.51 dated 2005-04-30 allows remote authenticated users to execute arbitrary commands by including shell metacharacters in a filename.
Vulnerability in PostgreSQL versions 7.3.x through 8.0.x grants public EXECUTE access to certain character conversion functions, allowing unprivileged users to call these functions with malicious values, with unknown impact.
Unknown vulnerability in the serendipity_config_local.inc.php file in Serendipity before version 0.8. The impact details are unknown.
SQL injection vulnerability in search.php in PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
The media manager in Serendipity before version 0.8 allows remote attackers to upload and execute arbitrary .php or .shtml files.
Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to perform administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL commands via parameters in various ASP scripts.
PHP remote file inclusion vulnerability in main.php of SitePanel 2.6.1 and earlier allows remote attackers to execute arbitrary PHP code via the p parameter.
A buffer overflow vulnerability in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.
Unknown vulnerability in the function used to validate path-names for uploading media in Serendipity before version 0.8. The impact details are unknown.
SQL injection vulnerability in the notes module for phpBB, in posting_notes.php, allows remote attackers to execute arbitrary SQL commands via the p parameter (used in the $post_id variable) and other attack vectors.
The vulnerability in the edit_image.asp script of Uapplication Uphotogallery allows remote attackers to upload arbitrary files to the server.
Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm), and other versions including 2.x, 3.x, and 4.x, allows remote attackers to execute arbitrary code via a command with crafted parameters to a RADEXECD process.
A buffer overflow vulnerability in HP Radia Notify Daemon 3.1.0.0 (formerly Novadigm) and versions 2.x, 3.x, and 4.x allows remote attackers to execute arbitrary code via a long file extension.
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
Vulnerability in the OHS component versions 1.0.2 through 10.x, when UseWebcacheIP is disabled, allows a remote attacker to bypass HTTP Server mod_access restrictions by sending a request to the webcache TCP port 7778.
Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.