CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
Multiple vulnerabilities in PWLib before version 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
The mksmbpasswd script in Samba 3.0.0 and 3.0.1 may overwrite the user password with an uninitialized buffer when creating an account marked as disabled. This could enable the account with a more easily guessable password.
Buffer overflow in the ReadFontAlias function in XFree86 versions 4.1.0 to 4.3.0 allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file.
Buffer overflow in the Extract Info Field Function for MSN and YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in ReadFontAlias from dirfile.c of XFree86 versions 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token.
Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
A stack-based buffer overflow in Check Point VPN-1 Server 4.1 through 4.1 SP6 and Check Point SecuRemote/SecureClient 4.1 through 4.1 build 4200 allows remote attackers to execute arbitrary code via an ISAKMP packet with a large Certificate Request packet.
Apache-SSL versions 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allow remote attackers to forge a client certificate by using basic authentication with the target user's 'one-line DN'.
Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.
Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server. Examples include using the GLOBALS[rootdp] parameter in db.php and the GLOBALS[language_home] parameter in archivednews.php with a malicious version of lang_admin.php.
Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such as ", `, |, ;, or $.
WWW File Share Pro version 2.42 and earlier allows remote attackers to bypass directory access restrictions via a URL with a trailing dot or a URI with a leading slash or backslash character.
Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to 'cause negative totals' via an order with a large quantity.
Multiple SQL injection vulnerabilities in phpGedView before version 2.65 allow remote attackers to execute arbitrary SQL via timeline.php and placelist.php.
The SPP_VerifyPVV function in nCipher payShield SPP library versions 1.3.12, 1.5.18, and 1.6.18 returns a Status_OK value even if the HSM returns a different status code. This could lead applications to make incorrect security-critical decisions, such as accepting an invalid PIN number.
Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in versions 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.
The CVE-2004-0068 vulnerability in PhpDig 1.6.5 and earlier allows remote attackers to execute arbitrary PHP code by modifying the $relative_script_path parameter to reference a URL on a remote web server containing the code.
Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code via a long Subject line.
Buffer overflow in DameWare Mini Remote Control before version 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.