CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Empris PHP script allows remote attackers to include arbitrary files from remote websites via an HTTP request that sets the includedir variable.
The Actionpoll PHP script before version 1.1.2 has a remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the includedir parameter.
The PHPAdsNew script allows remote attackers to include arbitrary files from remote websites via an HTTP request that sets the includedir variable.
The CCCSoftware CCC PHP script allows remote attackers to include arbitrary files from remote websites via an HTTP request that sets the includedir variable.
The Dark Hart Portal (darkportal) PHP script allows remote attackers to include arbitrary files from remote websites via an HTTP request that sets the includedir variable.
Phormation PHP script version 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote websites, using an HTTP request that modifies the phormationdir variable.
The myphpPagetool PHP script version 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote websites, using an HTTP request that modifies the includedir variable.
Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable.
The AWOL PHP script allows remote attackers to include arbitrary files from remote websites via an HTTP request that sets the includedir variable.
The pSlash PHP script version 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote websites, using an HTTP request that modifies the includedir variable.
Phorecast PHP script before 0.40 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
The CVE-2001-1123 vulnerability in Network Node Manager (NNM) version 6.2 and earlier allows a local user to execute arbitrary code, possibly via a buffer overflow in a long hostname or object ID.
Network Associates PGP Keyserver version 7.0 allows remote attackers to bypass authentication and access the administrative web interface via URLs that directly access cgi-bin instead of keyserver/cgi-bin for the programs (1) console, (2) cs, (3) multi_config, and (4) directory.
The Web Access component for COM2001 Alexis versions 2.0 and 2.1 sends usernames and voice mail passwords in clear text via a Java applet. This information is sent to port 8888 of the server, which could allow remote attackers to steal the passwords via sniffing.
The admin.php file in PHP-Nuke version 5.2 and earlier (except 5.0RC1) does not check login credentials for upload operations, allowing remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file.
The binary decoding feature of slrn 0.9 and earlier allows remote attackers to execute commands via shell scripts that are inserted into a news post.
A format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argument for (1) faxrm or (2) faxalter.
Buffer overflow in fbglyph.c in XFree86 before version 4.2.0, related to glyph clipping for large origins, allows attackers to cause a denial of service and possibly gain privileges via a large number of characters.
Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name.
Buffer overflow in cb_reset in the System Service Processor (SSP) package of SunOS 5.8 allows a local user to execute arbitrary code via a long argument.