CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
phpMyAdmin versions 2.2.0rc3 and earlier allow remote attackers to execute arbitrary commands by injecting them into the strCopyTableOK argument in tbl_copy.php or the strRenameTableOK argument in tbl_rename.php.
In prefs.php of phpBB version 1.4.0 and earlier, remote authenticated users can execute arbitrary PHP code via an invalid language value. This causes the variables $l_statsblock in prefs.php or $l_privnotify in auth.php to be improperly initialized.
The ip_masq_irc module version 2.2 allows remote attackers to bypass intended firewall restrictions by sending a 'DCC SEND' request to a malicious server listening on port 6667.
CGI scripts such as login.gas.bat in Entrust getAccess allow remote attackers to execute Java programs and possibly arbitrary commands by specifying an alternate -classpath argument.
Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. (dot dot) attack in the requested URL.
Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to various FTP commands. This vulnerability can be exploited through commands such as DELE, MDTM, and others.
Vulnerability in MasqMail before version 0.1.15 allows local users to gain privileges via piped aliases.
CVE-2001-1022 describes a format string vulnerability in the pic utility in groff 1.16.1 and other versions, and jgroff before 1.15. This allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command.
The default configuration of Sambar Server 5 and earlier uses a symmetric key compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure.
Mambo Site Server versions 3.0.0 through 3.0.5 have a vulnerability that allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters.
SonicWALL SOHO uses easily predictable TCP sequence numbers, allowing remote attackers to spoof or hijack sessions.
Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message.
Arkeia backup server version 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.
Buffer overflows in Pileup before 1.2 allow local users to gain root privileges via (1) long command line arguments, or (2) a long callsign.
Cross-site scripting vulnerability in CGIWrap before version 3.7 allows remote attackers to execute arbitrary Javascript on other web clients. Attackers can inject Javascript into error messages generated by CGIWrap.
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files.
The HTTP server for Cisco IOS versions 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands when local authorization is used by specifying a high access level in the URL.
The prepend.php3 file in PHPLib before version 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server.
The Horde Internet Messaging Program (IMP) before version 2.2.6 and 1.2.6 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript embedded in an email.
The dnskeygen tool in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for an HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG). This allows attackers to obtain the keys and perform dynamic DNS updates.