CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in the Javascript interpreter (jsinterp.c) in Mozilla and Firefox before version 1.5.1 allows a remote attacker to cause a denial of service (crash) or execute arbitrary code through improper object dereferencing during garbage collection.
The vulnerability in the function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and potentially execute arbitrary code via user-defined methods that trigger garbage collection operating on freed objects.
A vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey allows remote code execution by changing an element's style from position:relative to position:static, causing Gecko to operate on freed memory.
A vulnerability in BIND 4 and BIND 8 allows remote attackers to gain privileged access via a Kashpureff-style DNS cache corruption attack when the server is used as a target forwarder.
In SPIP 1.8.2-e and earlier, and 1.9 Alpha 2 (5539) and earlier, multiple SQL injection vulnerabilities exist in the file formulaires/inc-formulaire_forum.php3. Remote attackers can execute arbitrary SQL commands via the id_forum, id_article, or id_breve parameters to forum.php3, as well as through unspecified vectors related to session handling and when posting petitions.
SQL injection vulnerability in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the 'site' parameter in index.php.
SQL injection vulnerability in global.php in MyBB before version 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.
SQL injection vulnerability in the Authentication Servlet of Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via specially crafted URL requests.
The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.
SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.
MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, allowing remote attackers to perform unspecified privileged actions by directly accessing files via a URL.
A PHP remote file inclusion vulnerability in loginout.php of FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.
Multiple SQL injection vulnerabilities were found in PHP GEN before version 1.4. Unknown attack vectors allow remote attackers to inject arbitrary SQL commands.
Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via the catview parameter in cal_functions.inc.php and the login parameter in cal_login.php.
SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field.
SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
A vulnerability in Cisco VPN 3000 series concentrators running software versions 4.7.0 through 4.7.2.A allows remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.
A buffer overflow vulnerability in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a specially crafted playlist (.pls) file with an overly long filename in the File1 field.
A vulnerability in CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php.
Buffer overflow vulnerability in git-checkout-index in GIT before version 1.1.5. A remote attacker can exploit a specially crafted index file with a long symbolic link to execute arbitrary code.