CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in the logmsg function in svc.c in Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages.
The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via password_forgotten.php.
SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the admin_name or admin_pass parameters.
PHP remote file inclusion vulnerability in index.php of Php-Nuke versions 6.x through 7.3. A remote attacker can modify the modpath parameter to point to a URL on a remote server containing malicious PHP code, allowing arbitrary code execution on the server.
Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.
SCO OpenServer versions 5.0.5 through 5.0.7 only support Xauthority style access control when logging in using scologin. This allows remote attackers to gain unauthorized access to an X session via other X login methods.
An unknown vulnerability related to the handling of large requests in RAdmin for Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.
PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.
SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter in index.php or members.php, or the comment_id parameter in comments.php.
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Editing Component (DEC) and Javascript that calls showModalDialog.
Fastream NETFile Server 7.1.2 improperly handles keep-alive connection timeouts and does not close the connection after a HEAD request, allowing remote attackers to perform a denial of service (connection consumption) by sending a large number of HTTP HEAD requests.
An unknown vulnerability in Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP versions 6 and 7 on HP-UX in trusted mode allows attackers to bypass authentication and gain administrator rights.
Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors, possibly related to unspecified worms.
The DSS verification code in Dropbear SSH Server before version 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
A format string vulnerability in smtp.c in smtp.proxy version 1.1.3 and earlier allows remote attackers to execute arbitrary code by injecting format string specifiers into the client hostname or message-id, which are then processed in a syslog message.
SQL injection vulnerability in index.php in miniBB 1.7f and earlier allows remote attackers to execute arbitrary SQL commands via the 'user' parameter in a 'userinfo' action.
The vulnerability allows remote execution of PHP code by injecting an external URL into the appdir parameter in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier.
SQL injection vulnerability in Interchange before version 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
A buffer overflow in ADA Image Server (ImgSvr) 0.4 allows remote attackers to cause a denial of service (web server crash) or execute arbitrary code via a long GET request.