CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, related to the handling of HTML-formatted email.
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code. This is demonstrated using a script in a compiled help (CHM) file that references InfoTech Storage (ITS) protocol handlers.
The dissect_attribute_value_pairs function in packet-radius.c for Ethereal versions 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as backticks (`) in the password.
Multiple buffer overflows in ecartis before version 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8, possibly related to a configuration file setting.
The vulnerability in isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service by sending an ISAKMP packet with a malformed Cert Request payload, leading to an integer underflow in a malloc operation.
The libpam-pgsql library before version 0.5.2 has an SQL injection vulnerability that allows attackers to execute arbitrary SQL statements.
Buffer overflow in the win32_stat function for ActiveState's ActivePerl and Larry Wall's Perl before version 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.
Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.
Vulnerability in picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the $CONFIG['impath'] or $CONFIG['jpeg_qual'] parameters.
PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter to reference a URL on a remote web server that contains user_list_info_box.inc.
PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR parameter to reference a URL on a remote web server that contains functions.inc.php.
SMC Barricade broadband routers 7008ABR and 7004VBR have remote administration enabled by default, allowing remote attackers to gain access by connecting to port 1900.
The Samsung SmartEther SS6215S switch, and possibly other Samsung switches, allows remote attackers and local users to gain administrative access by providing the admin username followed by a password that is the maximum allowed length, then pressing the enter key after the resulting error message.
Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element.
SQL injection vulnerability in Video Gallery Module 0.1 Beta 5 for PHP-Nuke. An attacker can inject arbitrary SQL code via clipid or catid parameters in viewclip, viewcat, or voteclip actions.
Cross-site request forgery (CSRF) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary code by including the code in an image tag or a link.
The avatar upload capability in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to execute arbitrary script by uploading files that include scripting code such as Javascript.
SQL injection vulnerability in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password parameter.