CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W funkcji zend_hash_del_key_or_index w pliku zend_hash.c w PHP przed wersją 4.4.3 oraz 5.x przed wersją 5.1.3 może dojść do usunięcia niewłaściwego elementu przez zend_hash_del. To uniemożliwia poprawne usunięcie zmiennej, nawet gdy wywołana zostanie funkcja unset w PHP.
Nieokreślona podatność w funkcjonalności rozszerzenia sesji w PHP przed wersją 5.1.3, związana z uszkodzeniem sterty. Wpływ i wektory ataku są nieznane.
Podatność na wstrzykiwanie argumentów w WinSCP 3.8.1 build 328 umożliwia zdalnym atakującym przesyłanie lub pobieranie dowolnych plików poprzez zakodowane spacje i znaki podwójnego cudzysłowu w URI scp lub sftp.
Wielokrotne podatności na wstrzykiwanie SQL w Open Business Management (OBM) 1.0.3 pl1 umożliwiają zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez parametry new_order i order_dir w kilku plikach, a także parametry entity i tf_dateafter w pliku company/company_index.php.
An unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via unexpected data related to parameter validation in the DXImageTransform.Microsoft.Light ActiveX control, causing Internet Explorer to crash in a way that enables code execution.
Buffer overflow vulnerability in the Remote Access Connection Manager (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier. Remote unauthenticated or authenticated attackers can execute arbitrary code via crafted RPC requests, leading to registry and stack corruption.
An unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when saved as a multipart HTML (.mht) file.
Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls, causing memory corruption during garbage collection.
The SMB driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier contains a privilege escalation vulnerability. A local user can call the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER flag and an arbitrary kernel memory address, leading to arbitrary code execution.
A heap-based buffer overflow exists in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier. Remote attackers can execute arbitrary code via crafted UTF-8 encoded HTML that causes size discrepancies during Unicode conversion.
A buffer overflow vulnerability exists in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier. This allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.
A buffer overflow vulnerability exists in the Routing and Remote Access service (RRAS) on Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier. Remote unauthenticated or authenticated attackers can execute arbitrary code via crafted RPC requests.
A stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a specially crafted PNG image with a large chunk size.
An unspecified vulnerability in Microsoft PowerPoint in Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption.
An integer overflow in the PolyPolygon function of the Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted WMF or EMF image. The flaw occurs when the sum of entries in the vertex counts array and the number of polygons triggers a heap-based buffer overflow.
In MyBulletinBoard (MyBB) 1.1.2, the domecode function in inc/functions_post.php allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace call with the /e (executable) modifier.
Wielokrotne podatności na wstrzykiwanie SQL w Dominios Europa PICRATE (znanym również jako TAL RateMyPic) w wersji 1.0 pozwalają zdalnym atakującym na wykonywanie dowolnych poleceń SQL poprzez parametry (1) id, (2) voteid i (3) vfiel w pliku index.php oraz poprzez parametry (4) nick, (5) email, (6) city, (7) messen i (8) message w formularzu w pliku add.php.
SQL injection vulnerability in index.php of IntegraMOD 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded apostrophe characters in the STYLE_URL parameter.
Wielokrotne podatności na zdalne dołączanie plików w PHP w WebprojectDB w wersji 0.1.3 i wcześniejszych umożliwiają zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrze INCDIR w plikach (1) include/nav.php oraz (2) include/lang.php.
Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in footer.php and admin/footer.php.