CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in module.php for ezContents allows remote attackers to execute arbitrary PHP code by modifying the link parameter to reference a URL on a remote web server that contains the code.
The libCheckSignature function in crypto-utils.lib for OpenCA 0.9.1.6 and earlier only compares the serial numbers of certificates, which can lead to incorrect acceptance of signatures if the certificate chain is trusted by OpenCA.
Multiple vulnerabilities in the H.323 protocol implementation for Nortel Networks Business Communications Manager, Succession 1000 IP Trunk and IP Peer Networking, and 802.11 Wireless IP Gateway allow remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code via a long Subject line.
Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic.
The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries.
Buffer overflow in a component of Microsoft Data Access Components (MDAC) versions 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.
Buffer overflow in DameWare Mini Remote Control before version 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.
tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets.
Multiple vulnerabilities in the H.323 protocol implementation for Cisco IOS versions 11.3T through 12.2T allow remote attackers to cause a denial of service and possibly execute arbitrary code.
The PHP remote file inclusion vulnerability in EasyDynamicPages 2.0 allows remote attackers to execute arbitrary PHP code by modifying the edp_relative_path parameter to reference a malicious serverdata.php script on a remote web server.
An unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
The vulnerability in Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses. A remote attacker can bypass authentication by connecting from the same IP address as an active authenticated user.
Unknown vulnerability in SandSurfer before version 1.7.0 allows remote attackers to gain access as a logged-in user.
Vulnerability in Windows Media Player 9 allows remote attackers to execute arbitrary code via a specially crafted PNG file with large width or height values, known as the 'PNG Processing Vulnerability'.
Vulnerability in Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server via a modified chroot-again exploit using the chmod command.
vbox3 version 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, allowing local users to gain elevated privileges.
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions through various methods, such as using the NavigateAndFind method or window.open to load a JavaScript URL.
The calendar module for phpgroupware 0.9.14 does not enforce the 'save extension' feature for holiday files, allowing remote attackers to create and execute PHP files.
Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code.