CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.
TikiWiki before version 1.8.5 does not properly validate files uploaded to the temp directory, allowing remote attackers to upload and execute arbitrary PHP scripts.
A buffer overflow in a player logging function in the Tincat network library version 2.x before 2.0.28, used in games such as Sacred and The Settlers: Heritage of Kings, allows remote attackers to execute arbitrary code.
Multiple buffer overflows in the XSL parser for IceCast 2.20 may allow attackers to cause a denial of service and possibly execute arbitrary code via a long test value in an xsl:when tag, a long test value in an xsl:if tag, or a long select value in an xsl:value-of tag.
Vulnerability in ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.
Unknown major security flaws related to input validation were found in Ulog-php before version 1.0. They are probably SQL injection vulnerabilities in host.php, port.php, and index.php.
SQL injection vulnerability in marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category parameter.
In the modes.c file in smail 3.2.0.120, signal handlers are implemented using unsafe library calls. This may allow attackers to execute arbitrary code via signal handler race conditions, possibly using xmalloc.
Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when using the hugemem kernel, allows local users to read and write to arbitrary kernel memory and gain privileges via certain syscalls.
Vulnerability in the SimpleXMLRPCServer module in Python 2.2, 2.3 before 2.3.5, and 2.4 allows remote attackers to read or modify module globals and potentially execute arbitrary code when an XML-RPC server uses register_instance without a _dispatch method.
A vulnerability in Windows 2000, XP, and Server 2003 due to improper validation of memory regions for COM structured storage files allows an attacker to execute arbitrary code via a specially crafted file.
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the 'Input Validation Vulnerability.'
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
The vulnerability in mod_python version 2.7.8 and earlier allows a remote attacker to access restricted objects via a crafted URL.
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
A format string vulnerability in the a_Interface_msg function in Dillo before version 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
A heap-based buffer overflow in psd.c in ImageMagick versions 6.1.0, 6.1.7, and earlier allows remote attackers to execute arbitrary code via a specially crafted .PSD image file with a large number of layers.
Multiple SQL injection vulnerabilities were found in PostNuke 0.760-RC2 in index.php, modules.php, and admin.php. A remote attacker can manipulate the catid parameter to execute arbitrary SQL code.
PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the path_prefix parameter to reference a URL on a remote web server that contains the code.