CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request or invalid arguments to layout/professional/functions.php or getimage.php.
In EVA-Web 2.1.2 and earlier, an unspecified script (probably index.php) reveals the full web server path when invalid 'perso' or 'aide' parameters are passed.
Multiple PHP remote file inclusion vulnerabilities in EzUpload Pro 2.10 allow remote attackers to execute arbitrary PHP code by supplying a malicious URL in the 'path' parameter to form.php, customize.php, and initialize.php.
WordPress 2.0.2 and earlier versions contain a direct static code injection vulnerability. An attacker can remotely execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which appends the code to files in cache directories.
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP code via a URL in the 'lang' parameter to business.php, credits.php, or help.php in the modules/credits directory.
Multiple SQL injection vulnerabilities exist in Tamber Forum 1.9.13 and earlier. Remote attackers can execute arbitrary SQL commands via various parameters in ASP scripts.
A PHP remote file inclusion vulnerability in V-Webmail 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter in includes/mailaccess/pop3/core.php.
A remote file inclusion vulnerability in V-Webmail 1.5 through 1.6.4 allows arbitrary PHP code execution via the CONFIG[pear_dir] parameter in includes/mailaccess/pop3.php. An attacker can inject a malicious URL to execute code.
A denial of service vulnerability exists in libs/comverp.c of Courier MTA before version 0.53.2. Unknown attack vectors using the '=' character in usernames cause excessive CPU consumption.
A stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might allow attackers to execute arbitrary code via a long filename.
An untrusted search path vulnerability in update_flash for IBM AIX 5.1, 5.2 and 5.3 allows local users to execute arbitrary commands via unknown vectors involving lsmcode and possibly other commands.
A buffer overflow vulnerability exists in Alt-N MDaemon, possibly version 9.0.1 and earlier. A remote attacker can exploit a long A0001 argument starting with a double quote (") to execute arbitrary code.
A remote file inclusion vulnerability in Plume 1.0.3 via the _PX_config[manager_path] parameter in manager/frontinc/prepend.php allows attackers to execute arbitrary PHP code.
A vulnerability in newsadmin.asp of Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ".
SQL injection vulnerability in cosmicshop/search.php of CosmicShoppingCart allows remote attackers to execute arbitrary SQL commands via the max parameter.
Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, distinct from CVE-2006-2480.
A stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack vectors.
The ping.php script in Russcom.Ping allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the domain parameter.
SQL injection vulnerability in the search script of AlstraSoft Web Host Directory 1.2 (also known as HyperStop WebHost Directory 1.2) allows remote attackers to execute arbitrary SQL commands via the uri parameter.
In Vixie cron 4.1, the do_command.c file does not check the return code of a setuid call. If setuid fails (e.g., due to PAM errors or resource limits), a local user could potentially gain root privileges.