CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the i-mall.cgi script of I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters in the p parameter.
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.
SQL injection vulnerability in the Reviews module of PHP-Nuke versions 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Buffer overflow vulnerability in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 allows remote attackers to execute arbitrary code via an HTML message with long tag text.
Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.
An unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. The provenance of this information is unknown; details are obtained from third party reports.
Fastream NETFile Server 7.1.2 improperly handles keep-alive connection timeouts and does not close the connection after a HEAD request, allowing remote attackers to perform a denial of service (connection consumption) by sending a large number of HTTP HEAD requests.
Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors, possibly related to unspecified worms.
A vulnerability in the radmin software in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allows remote access via port 25072 using the default password 'jstwo'.
The read_list_from_file function in vacation.pl for OpenWebmail before version 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.
Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.
Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.
Vulnerability in Windows XP Explorer allows attackers to execute arbitrary code via a specially crafted self-executing folder containing HTML and script that references an executable file within the same folder, which is automatically executed when a user accesses the folder.
In the Linux kernel 2.4.25 and earlier, an integer overflow exists in the SCTP_SOCKOPT_DEBUG_NAME socket option. A local user can pass an optlen value of -1, causing kmalloc to allocate 0 bytes of memory, enabling arbitrary code execution.
The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
SQL injection vulnerability in action.php in Nucleus CMS 3.01 allows remote attackers to execute arbitrary SQL statements via the itemid parameter.
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
An unknown security vulnerability was discovered in phpGroupWare before version 0.9.14.002 in the Setup/Config functionality. This vulnerability may be exploited via unknown attack vectors and lead to unspecified impacts.