CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The MIME transformation system in phpMyAdmin versions 2.5.0 through 2.6.0-pl1 contains a vulnerability that allows remote attackers to execute arbitrary commands by injecting shell metacharacters in unspecified vectors.
Buffer overflow vulnerability in the IsValidFile function of the ADM ActiveX control in Altnet Download Manager 4.0.0.4 and earlier, used in Kazaa Media Desktop 1.3–2.6.4 and Grokkster 1.3–2.6, allows remote attackers to execute arbitrary code via a long bstrFilepath parameter.
Vulnerability in Axis Network Camera version 2.40 and earlier, and Axis Video Server version 3.12 and earlier, allows remote attackers to execute arbitrary commands by sending an accent (`) or other shell metacharacters in the query string to virtualinput.cgi.
The exit_thread function in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.
The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.
Unknown vulnerability in IlohaMail before version 0.8.14-rc1 has unknown impact and attack vectors.
Serv-U FTP server before version 5.1.0.0 has a default account and password for local administration. A local user can use this account to create a new user, log in as that user, and then execute arbitrary commands using the SITE EXEC command.
phpMyAdmin versions 2.5.1 through 2.5.7 contain a vulnerability that allows remote attackers to modify configuration settings by manipulating $cfg['Servers'] variables, potentially leading to unauthorized access to MySQL servers.
An unknown security vulnerability was discovered in phpGroupWare before version 0.9.14.002 in the Setup/Config functionality. This vulnerability may be exploited via unknown attack vectors and lead to unspecified impacts.
Vulnerability in Windows XP Explorer allows a local user to execute arbitrary code via a system folder containing a Desktop.ini file with a .ShellClassInfo specifier that has a CLSID value associated with an executable file.
Vulnerability in Windows XP Explorer allows attackers to execute arbitrary code via a specially crafted self-executing folder containing HTML and script that references an executable file within the same folder, which is automatically executed when a user accesses the folder.
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php.
Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Editing Component (DEC) and Javascript that calls showModalDialog.
Format string vulnerability in the log function in SUS 2.0.2 and other versions before 2.0.6 allows local users to execute arbitrary code via format string specifiers in a command line argument that is passed directly to syslog.
SQL injection vulnerability in index.php in miniBB 1.7f and earlier allows remote attackers to execute arbitrary SQL commands via the 'user' parameter in a 'userinfo' action.
Unknown vulnerability in ignitionServer 0.1.2 through 0.3.1, with the linking service enabled, allows remote attackers to bypass authentication.
Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 allows remote attackers to execute arbitrary code via an HTML message with long tag text.
Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts.