CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Twilight Webserver version 1.3.3.0 allows remote attackers to cause an application crash via a GET request for a long URI, which is a different vulnerability than CVE-2004-2376.
SQL injection vulnerability in auth.php in Land Down Under (LDU) v601 and earlier allows remote attackers to execute arbitrary SQL commands.
Multiple PHP remote file inclusion vulnerabilities in EternalMart Mailing List Manager (EMLM) 1.32 allow remote attackers to execute arbitrary PHP code via a URL in the emml_admin_path parameter to admin/auth.php or the emml_path parameter to emml_email_func.php.
VMware ESX Server 1.5.2 before Patch 4 allows local users to execute arbitrary programs as root via certain modified VMware ESX Server environment variables.
Sambar Server before version 6.0 beta 6 has a security vulnerability that allows remote attackers to send proxy HTTP requests to the server's administrative interface and external web servers if the security.ini file lacks a proxydeny entry for 127.0.0.1.
KaZaA Media Desktop (KMD) version 2.0 launches advertisements in the Internet Explorer local security zone, which could allow remote attackers to view local files and possibly execute arbitrary code.
Multiple buffer overflows in Winamp 3.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .b4s file containing a long playlist name or a long path in a file argument to the Playstring parameter.
The vulnerability in Bookmark4U 1.8.3 allows remote attackers to execute arbitrary PHP code by including a remote file via the prefix parameter in dbase.php, config.php, or common.load.php.
The register.php file in S8Forum 3.0 has a vulnerability that allows remote attackers to execute arbitrary PHP commands. This can be achieved by creating a user whose name ends with a .php extension and entering commands in the E-mail field.
H-Sphere WebShell version 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL request.
CVE-2003-1244 describes an SQL injection vulnerability in page_header.php in phpBB versions 2.0, 2.0.1, and 2.0.2. It allows remote attackers to brute force user passwords, potentially gaining unauthorized access to forums.
X509TrustManager in Java Secure Socket Extension (JSSE) incorrectly calls the isClientTrusted method when determining server trust, leading to improper validation of digital certificates.
Buffer overflow in the prepare_reply function in request.c for Mathopd versions 1.2 through 1.5b13, and possibly earlier, allows remote attackers to cause a denial of service (server crash) and potentially execute arbitrary code via an HTTP request with a long path.
A PHP remote file inclusion vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long AUTH command to the POP3 server or AUTHENTICATE command to the IMAP server.
CVE-2003-1171 involves a heap-based buffer overflow in the sec_filter_out function in mod_security versions 1.7RC1 through 1.7.1 in Apache 2. This allows remote attackers to execute arbitrary code via a server-side script that sends a large amount of data.
KPopup 0.9.1 has a vulnerability related to trusting the PATH variable when executing the killall command. This allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.
The exit.c file in Linux kernel 2.6-test9-CVS was modified to contain a backdoor, allowing local users to elevate their privileges by passing __WCLONE|__WALL to the sys_wait4 function.
A vulnerability in KnowledgeBuilder (KnowledgeBase) allows remote attackers to execute arbitrary PHP code by modifying the 'page' parameter to reference a URL on a remote web server containing the code.
Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model.