CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The SMTP server in Apache Java Mail Enterprise Server (Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) by sending a long argument to the MAIL command.
Cantico Ovidentia 5.8.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can remotely execute arbitrary PHP code by sending a crafted URL in the babInstallPath parameter to many scripts.
SQL injection vulnerability in bolum.php in tekno.Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. The details are obtained solely from third party information.
PHP remote file inclusion vulnerability in common-menu.php of Informium 0.12.0. An attacker can execute arbitrary PHP code by sending a crafted URL in the CONF[local_path] parameter.
SQL injection vulnerability in admin/default.asp of Dusan Drobac CodeAvalanche FreeForum (CAForum) 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
A directory traversal vulnerability in the easy-scart.cgi script in iShopCart allows remote attackers to read arbitrary files on the server by using a '..' sequence in the query string.
SQL injection vulnerability in sessions.inc of PHP Base Library (PHPLib) before version 7.4a allows remote attackers to execute arbitrary SQL commands via the id variable, set by the client through a query string or a cookie.
SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1 allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when settings specify only "Search in Detailed description" and "Search also in ISBN." The vendor disputed this issue, claiming the bug does not pose a security threat.
Multiple SQL injection vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to execute arbitrary SQL commands via the u_a or u_s parameters.
The vulnerability in Hesabim.asp in ASPSitem 2.0 and earlier allows remote attackers to read private messages of other users by modifying the id parameter.
SQL injection vulnerability in Anket.asp of ASPSitem 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
SQL injection vulnerability in misc.php in Woltlab Burning Board (WBB) 2.3.4 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
phpCommunityCalendar 4.0.3 has multiple SQL injection vulnerabilities in CalendarDetailsID, ID, AdminUserID, EventLocationID, and LocationID parameters, allowing arbitrary SQL command execution.
A package component in Sun Storage Automated Diagnostic Environment (StorADE) 2.4 uses world-writable permissions for certain critical files and directories, which allows local users to gain privileges.
A double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via crafted JavaScript code.
The vulnerability in the EvalInSandbox function in Mozilla Firefox and Thunderbird before version 1.5.0.4 allows a remote attacker to gain elevated privileges via JavaScript that calls the valueOf method on objects created outside the sandbox.
A vulnerability in Mozilla Firefox and Thunderbird before version 1.5.0.4 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code through multiple vectors, such as nested <option> tags in a select tag, a DOMNodeRemoved mutation event, content-implemented tree views, BoxObjects, the XBL implementation, and an iframe attempting to remove itself, leading to memory corruption.
An integer overflow in Mozilla Firefox and Thunderbird before version 1.5.0.4 in the 'jsstr tagify' function allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code through memory corruption.
An unspecified vulnerability in Mozilla Firefox before version 1.5.0.4 and SeaMonkey before version 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context.
In Mozilla Firefox and Thunderbird before version 1.5.0.4, XUL attributes are incorrectly associated with the wrong URL under certain unspecified circumstances. This could allow a remote attacker to bypass restrictions by causing a persisted string to be associated with the wrong URL.