CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in sudo before version 1.6.8p2 allows local users to execute arbitrary commands by using '()' style environment variables to create functions with the same name as any program called within a bash script without using the full pathname.
RaidenHTTPD 1.1.32 and possibly earlier versions before 1.1.34 contain a buffer overflow vulnerability. A remote attacker can exploit a long URL to execute arbitrary code on the server.
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.
Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.
Vulnerability in fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary configuration file by starting an suid process and pointing the fcronsighup configuration file to a /proc entry that is owned by root but modifiable by the user, such as /proc/self/cmdline or /proc/self/environ.
A heap-based buffer overflow in server.cpp of WebMod 0.47 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a POST request with a Content-Length header smaller than the actual data sent.
The vulnerability in bsmtpd 2.3 and earlier versions is due to improper sanitization of email addresses, allowing a remote attacker to execute arbitrary commands.
A vulnerability in the ImageGalleryPlugin (ImageGalleryPlugin.pm) for Twiki allows a remote attacker to execute arbitrary system commands via specially crafted thumbnail generation commands.
Vulnerability in ArGoSoft FTP Server before version 1.4.2.8 allows remote attackers to read arbitrary files via shortcut (.LNK) files in the SITE COPY command. This is a different vulnerability than CVE-2005-0519.
Cross-Site Request Forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.
Vulnerability in misc.php in vBulletin 3.0.6 and earlier, when 'Add Template Name in HTML Comments' is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
Multiple integer overflows in the sftp_pkt_getstring and fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56 and earlier allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory allocation.
The RgSecurity form in the HTTP server of the Thomson TCW690 cable modem (firmware 2.1, software ST42.03.0a) allows an attacker on the LAN to change the password without proper validation via a direct POST request.
PHP remote file inclusion vulnerability in Tar.php of Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
Multiple SQL injection vulnerabilities in page.php for iGeneric (iG) Shop 1.2 allow remote attackers to execute arbitrary SQL statements via the cats, l_price, or u_price parameters.
PHP remote file inclusion vulnerability in mail_autocheck.php of the Email This Entry add-on for pMachine Pro 2.4 (and possibly other versions including pMachine Free). An attacker can directly request mail_autocheck.php and modify the pm_path parameter to reference a URL on a remote server containing malicious PHP code, leading to its execution.
Vulnerability in ArGoSoft FTP Server before version 1.4.2.7 allows remote attackers to read arbitrary files on the server. The attack involves uploading a ZIP archive containing a shortcut (.LNK) file, then using the SITE UNZIP command to extract it on the server and accessing the file.
Directory traversal vulnerability in CitrusDB 0.3.6 and earlier allows remote and local attackers to include arbitrary PHP files via '..' sequences in the 'load' parameter in index.php.
Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.
Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.