CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.
Buffer overflow in luxman before version 0.41, when used with certain insecure svgalib libraries, allows local users to execute arbitrary code via a long -f command line argument.
phpMyAdmin 2.6.1 contains multiple PHP remote file inclusion vulnerabilities. An attacker can modify the 'theme' parameter in phpmyadmin.css.php or the 'cfg[Server][extension]' parameter in database_interface.lib.php to point to a remote server containing malicious code, leading to arbitrary PHP code execution.
The kimgio library in KDE 3.4.0 contains a buffer overflow vulnerability when processing PCX image files. A remote attacker can exploit this by sending a crafted PCX file, potentially leading to arbitrary code execution.
Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.
The vulnerability in sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges by manipulating the autologinid value in a cookie.
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
A buffer overflow vulnerability in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows a local user to gain privileges via a specially crafted application.
Multiple vulnerabilities in fliccd, installed setuid root as part of the kdeedu Kstars support for INDI in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
Multiple SQL injection vulnerabilities in album_search.php in Photo Album 2.0.53 for phpBB allow remote attackers to execute arbitrary SQL commands via the mode or search parameters.
The Hyperlink Object Library in Windows 98, 2000, XP, and Server 2003 contains a buffer overflow that can be exploited by a remote attacker to execute arbitrary code via a crafted link.
The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension.
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the 'DHTML Method Heap Memory Corruption Vulnerability'.
Stack-based buffer overflow in the RespondeHTTPPendiente function in the HTTP server for SUMUS 0.2.2 allows remote attackers to execute arbitrary code via a large packet sent to TCP port 81.
Unknown vulnerability in Webmin and Usermin before version 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
Gigafast router (also known as CompUSA router) allows remote attackers to gain sensitive information and bypass the login page via a direct request to backup.cfg, which reveals the administrator password in plaintext.
Buffer overflow vulnerability in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command.
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the 'Server Message Block Vulnerability,' and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the path_prefix parameter to reference a URL on a remote web server that contains the code.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.