CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitrary code.
The addImage method in admin.class.php of Image Gallery Web Application 0.9.10 does not properly validate filenames, allowing remote attackers to upload and execute arbitrary files.
PHP remote file inclusion vulnerability in index.php of GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 'doc' parameter to reference a URL on a remote web server containing the code.
Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to execute arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp, or (4) txtUserEmail parameter to forgot.asp.
SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via the username field on the login page or the eventid parameter to calendar.asp.
Unknown vulnerability in the management station in HP StorageWorks Command View XP 1.8B and earlier allows remote attackers to bypass access restrictions.
PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the t_core_path parameter to bug_api.php or t_core_dir parameter to relationship_api.php to reference a URL on a remote web server that contains the code.
The web interface of the Micronet Wireless Broadband Router SP916BM running firmware before version 1.9 dated 08/04/2004 resets the password to the default when the router is powered off, which could allow remote attackers to gain access.
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
SQL injection vulnerability in include.php in PHPKIT versions 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code via a long DNS command.
Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.
A format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a content URL, as demonstrated in the filename portion of a .mp3 file.
Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is also affected.
A buffer overflow vulnerability in the WriteToLog function of JRun web server connectors versions 3.0 through 4.0, such as mod_jrun and mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
The vulnerability in Star before version 1.5_alpha46 is that the program does not drop the effective user ID (euid) before calling external programs. This allows local users to gain privileges by modifying the RSH environment variable to point to a malicious program.
Format string vulnerability in telnetd-ssl version 0.17 and earlier allows remote attackers to execute arbitrary code.
The POSIX Capability Linux Security Module (LSM) for Linux kernel 2.6 does not properly handle the credentials of a process that is launched before the module is loaded, which allows local users to gain privileges.
A buffer overflow in layer2.c of mpg123 version 0.59r and possibly 0.59s allows remote attackers to execute arbitrary code via a specially crafted MP3 or MP2 file.
Multiple buffer overflows in MMDF on OpenServer 5.0.6 and 5.0.7, and possibly other operating systems, may allow attackers to execute arbitrary code, as demonstrated via the execmail program.