CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.
The scosession program in OpenServer 5.0.6 and 5.0.7 allows local users to gain privileges via crafted strings on the commandline.
PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.
A buffer overflow vulnerability in the wsprintf function of W32Dasm version 8.93 and earlier allows remote attackers to execute arbitrary code by providing a long import or export function name.
A stack-based buffer overflow in DataRescue Interactive Disassembler (IDA) Pro 4.7 allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.
Buffer overflow vulnerability in Golden FTP Server Pro (goldenftpd) 2.x allows remote attackers to execute arbitrary code via a long RNTO command.
Buffer overflow in the -v and -a switches in mRouter in iSync 1.5 in Mac OS X 10.3.7 and earlier allows local users to execute arbitrary code.
The vulnerability in Enscript 1.6.3 is due to the lack of filename sanitization, allowing remote attackers or local users to execute arbitrary commands via crafted filenames.
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
Multiple buffer overflows in YaMT before version 0.5_2 allow attackers to execute arbitrary code via the rename or sort options.
SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges.
AWStats 6.1 and versions before 6.3 allow remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to awstats.pl.
In PHP Gift Registry (phpGiftReg) 1.4.0 and possibly earlier versions before 1.5.0b1, multiple SQL injection vulnerabilities exist in index.php. Remote attackers can execute arbitrary SQL commands via the messageid, shopper, shopfor, or itemid parameters.
A vulnerability in the NETGEAR FVS318 router running firmware version 2.4, and possibly other versions, allows remote attackers to bypass filters by using hex-encoded URLs, for example by encoding a file extension.
Vulnerability in the inpview tool in SGI IRIX allows local users to execute arbitrary commands via the SUN_TTSESSION_CMD environment variable, which is executed by inpview without dropping privileges.
Stack-based buffer overflow in the websql CGI program in MySQL MaxDB 7.5.00 allows remote attackers to execute arbitrary code via a long password parameter.
PHP remote file inclusion vulnerability in SGallery 1.01 allows attackers to execute arbitrary PHP code by modifying the DOCUMENT_ROOT parameter to reference a URL on a remote server containing config.php or sql_layer.php.
The Indexing Service in Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Buffer overflow in mpg123 before 0.59s-r9 allows remote attackers to execute arbitrary code via frame headers in MP2 or MP3 files.
The gui_popup_view_fly function in gui_tview_popup.c in junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.