CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in mod_python version 2.7.8 and earlier allows a remote attacker to access restricted objects via a crafted URL.
A vulnerability in Windows 2000, XP, and Server 2003 due to improper validation of memory regions for COM structured storage files allows an attacker to execute arbitrary code via a specially crafted file.
The Hyperlink Object Library in Windows 98, 2000, XP, and Server 2003 contains a buffer overflow that can be exploited by a remote attacker to execute arbitrary code via a crafted link.
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the 'Input Validation Vulnerability.'
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the 'DHTML Method Heap Memory Corruption Vulnerability'.
SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.
Lightspeed DeluxeFTP 6.01 stores usernames and passwords in plaintext in sites.xml, which is world-readable, allowing local users to gain privileges.
OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute arbitrary commands via a UNC path in a bookmark.
The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the href attribute, aka "Firelinking".
A buffer overflow vulnerability in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, also known as the 'URL Parsing Memory Corruption Vulnerability.'
A buffer overflow vulnerability in the decode_post function in ELOG before version 2.5.7 allows remote attackers to execute arbitrary code via attachments with long file names.
Multiple SQL injection vulnerabilities in DCP-Portal 6.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the lcat, doc, or uid parameters to index.php, or (2) the mid or bid parameters to forums.php.
A vulnerability in the Linux kernel 2.6 before version 2.6.11 allows a local user to gain elevated privileges by injecting mouse or keyboard events into other user sessions. The issue is due to missing access restrictions on the N_MOUSE line discipline for a TTY.
Vulnerability in AS/400 Telnet 5250 terminal emulation clients (IBM Client Access, Bosanova, PowerTerm, Mochasoft, and others) allows malicious AS/400 servers to execute arbitrary commands on the client workstation. The attack uses a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC Command), e.g., to create a backdoor account via REXEC.
SQL injection vulnerability in Oracle Forms 10g allows remote attackers to execute arbitrary SQL commands via the Query/Where feature.
PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.
Multiple buffer overflows in Cain & Abel before version 2.67 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via (1) an IKE packet with a large ID field that is not properly handled by the PSK sniffer filter, (2) the HTTP sniffer filter, or the (3) POP3, (4) SMTP, (5) IMAP, (6) NNTP, or (7) TDS sniffer filters.
SQL injection vulnerability in NotifyLink before version 3.0 allows remote attackers to execute arbitrary SQL commands via the URL.
The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument.
Buffer overflow vulnerability in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.