CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in IBM Parallel Environment (PE) 3.2 and 4.1 allows attackers to execute arbitrary commands as root via unknown vectors in the sample code.
An unspecified vulnerability exists in SurgeMail before version 2.2c10 related to a Webmail security bug. The impact and attack vectors are unknown.
A stack-based buffer overflow in the DecodeBase16 function, used in the IRC module and web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string.
A format string vulnerability in the logging function of IGI 2 Covert Strike server version 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.
Unspecified vulnerability in ArGoSoft FTP server before version 1.4.2.2 allows attackers to upload .lnk files via unknown vectors.
SQL injection vulnerability in the Reviews module of PHP-Nuke versions 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Omnicron OmniHTTPd version 3.0a and earlier contains a buffer overflow vulnerability in the handling of the Range header in HTTP GET requests. A remote attacker can exploit this to execute arbitrary code on the server.
Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.
Buffer overflow vulnerability in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via a long SELECT command.
Unspecified vulnerability in ASN.1 Compiler (asn1c) before version 0.9.7, occurring when processing "CHOICE" types with "indefinite length structures." Impact and attack vectors are unknown.
Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument. NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.
Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.
Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 allows remote attackers to execute arbitrary code via an HTML message with long tag text.
SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter in index.php or members.php, or the comment_id parameter in comments.php.
Eval injection vulnerability in left.php of phpMyAdmin versions 2.5.1 through 2.5.7, when LeftFrameLight is set to FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
The SMTP service in SmarterTools SmarterMail versions 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors, possibly related to unspecified worms.
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
An unknown security vulnerability was discovered in phpGroupWare before version 0.9.14.002 in the Setup/Config functionality. This vulnerability may be exploited via unknown attack vectors and lead to unspecified impacts.