CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The savesettings.php file in phpGB version 1.20 and earlier does not require authentication, allowing remote attackers to cause a denial of service or execute arbitrary PHP code by modifying config.php.
The scponly program does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls.
In Cacti before version 0.6.8, the graphs.php file allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
The upgrade of IRIX on Origin 3000 to versions 6.5.13-6.5.16 changes the system's MAC address, which could affect intended access restrictions based on the MAC address.
Belkin F5D5230-4 4-Port Cable/DSL Gateway Router version 1.20.000 modifies the source IP address of internal packets to that of the router's external interface when forwarding a request from an internal host to an internal web server. This allows remote attackers to hide which host is being used to access the web server.
TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, allowing remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.
An unknown vulnerability in HP OpenView EMANATE 14.2 snmpModules allows the SNMP read-write community name to be exposed. The issue relates to both 'read-only' community access and an easily guessable community name.
Versions of Achievo from 0.7.0 to 0.9.1, except for 0.8.2, contain a vulnerability in class.atkdateattribute.js.php that allows remote attackers to execute arbitrary PHP code. This issue occurs when the 'allow_url_fopen' setting is enabled and the config_atkroot parameter points to malicious code.
In dotProject version 0.2.1.5, there is a vulnerability that allows remote attackers to bypass authentication using a cookie or URL with the user_cookie parameter set to 1.
HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.
Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter.
FUDforum versions before 2.2.0 have SQL injection vulnerabilities that allow remote attackers to perform unauthorized database operations via report.php, selmsg.php, and showposts.php.
The Gallery photo album package before version 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL containing a malicious init.php script.
The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, allowing remote attackers to modify home pages of other users.
Multiple buffer overflows in Tomahawk SteelArrow before version 4.5 allow remote attackers to execute arbitrary code. The attack can be carried out via long UserIdent Cookie headers, long .aro files, or requests using Chunked Transfer-Encoding.
RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ 'Secure IP' (SSL) option during a connection.
CVE-2002-0690 describes a format string vulnerability in McAfee Security ePolicy Orchestrator (ePO) 2.5.1 that allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings.
The web handler for Perl 5.003 on Novell NetWare 5.1 and 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.
Unknown vulnerability in passwd for VVOS HP-UX 11.04, related to 'unexpected behavior'.
The Gateway GS-400 server has a default root password of '0001n' that cannot be changed via the administrative interface, allowing attackers to gain root privileges.