CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property, leading to a heap-based buffer overflow.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
A vulnerability in nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a 'particular sequence of HTML tags' leading to memory corruption.
An eval injection vulnerability in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the $method and $args parameters in pajax_call_dispatcher.php.
Adobe Document Server for Reader Extensions 6.0 lacks proper access control, allowing remote authenticated users to perform privileged actions by modifying the actionID and pageID parameters.
Multiple SQL injection vulnerabilities in Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the blogid, m, y, and sql parameters.
A directory traversal vulnerability in the pbcs.dll component of SAXoTECH SAXoPRESS (formerly Publicus) allows remote attackers to read arbitrary files and potentially execute arbitrary programs by using '..' sequences in the url parameter.
Multiple PHP remote file inclusion vulnerabilities in AzDGVote allow an attacker to execute arbitrary PHP code by supplying a URL in the int_path parameter. The affected files are vote.php, view.php, admin.php, and admin/index.php.
A directory traversal vulnerability in doc/index.php in Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter. The attack can be performed by injecting PHP code into the Apache error_log file, which is then included by doc/index.php.
PHP remote file inclusion vulnerability in doc/index.php in Simplog 0.9.2 and earlier. Remote attackers can execute arbitrary PHP code by supplying a crafted URL in the 's' parameter.
INDEXU 5.0.0 and 5.0.1 contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the theme_path parameter in 25 scripts and the base_path parameter in invoice.php to execute arbitrary PHP code.
In Debian GNU/Linux, during the configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, debconf uses the world-readable config.dat file instead of the restricted passwords.dat file to store the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, allowing local users to view the password.
A PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the root_path parameter. This issue also affects versions 1.4.2 and earlier.
A vulnerability in HP System Management Homepage (SMH) 2.1.3.132 running on CompaqHTTPServer/9.9 (Windows, Linux, Tru64 UNIX) allows remote attackers to bypass authentication via a crafted URL when 'Trust by Certificates' is not enabled.
Hosting Controller 6.1 stores the file forum/db/forum.mdb under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information such as usernames and passwords.
A directory traversal vulnerability exists in index.php of blur6ex 0.3.452 via the 'shard' parameter, allowing remote attackers to include arbitrary files. This can also lead to XSS and path disclosure.
SQL injection vulnerability in index.php of Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.