CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Bugzilla 2.16.3 and earlier, the editproducts.cgi script, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted. This allows users with those privileges to perform unauthorized additions to the next group assigned with the original group ID.
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
Integer overflow in the SOAPParameter object constructor in Netscape version 7.0 and 7.1 and Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.
In Bugzilla versions 2.17.3 and 2.17.4, the describecomponents.cgi script does not properly verify group membership, allowing remote attackers to list component descriptions for otherwise restricted products.
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4 allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
Vulnerability in Mozilla before version 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote websites to hijack the user interface using the 'chrome' flag and XUL files.
Unspecified vulnerability in Mac OS X before version 10.3.4 related to logging when tracing system calls. The impact and attack vectors are unknown.
Unknown vulnerability in LoginWindow for Mac OS X 10.3.4, related to handling of directory services lookups.
Multiple buffer overflows in Midnight Commander (mc) before version 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
ProFTPD version 1.2.9 incorrectly treats Allow and Deny directives for CIDR based ACL entries, which could allow FTP clients to bypass intended access restrictions.
The libcpr in SGI IRIX before version 6.5.25 has a vulnerability that allows local users to gain privileges by loading a user-provided library while restarting the checkpointed process.
Buffer overflow vulnerability in the uudecoding feature of Adobe Acrobat Reader for Unix and Linux allows remote attackers to execute arbitrary code by providing a PDF file with a long filename.
Buffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVE-2004-0425 describes a heap-based buffer overflow in SiteMinder Affiliate Agent 4.x that allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
The uudecode feature in Adobe Acrobat Reader for Unix and Linux allows remote attackers to execute arbitrary code by using shell metacharacters (backtick) in the PDF filename.
Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.
Multiple buffer overflows in the RTSP client for MPlayer before version 1.0pre4 and xine lib before version 1-rc4 may lead to crashes and potentially allow remote attackers to execute arbitrary code.
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14 may allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive.
SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.