CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the articleid parameter to article.php.
PHP remote file inclusion vulnerability in admin/header.php of PHP mcNews 1.3 allows remote attackers to execute arbitrary PHP code by modifying the skinfile parameter to reference a URL on a remote web server that contains the code.
Multiple buffer overflows in the dissect_a11_radius function in the CDMA A11 (3G-A11) dissector (packet-3g-a11.c) for Ethereal 0.10.9 and earlier allow remote attackers to execute arbitrary code via RADIUS authentication packets with large length values.
PHP remote file inclusion vulnerability in download_center_lite.inc.php for Download Center Lite 1.6 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code.
A buffer overflow vulnerability in JoWood Chaser version 1.50 and earlier allows remote attackers to cause a denial of service (client or server crash) and execute arbitrary code via a long nickname.
In mlterm versions 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, an integer overflow exists. A remote attacker can exploit a large image file used as a background to execute arbitrary code.
A vulnerability in the includer.cgi script of The Includer allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the URL or template parameter.
SQL injection vulnerability in the process_picture function in xp_publish.php in CopperExport 0.2.1 allows remote attackers to execute arbitrary SQL commands, possibly via the title, caption, or keywords parameters.
In the Linux kernel before version 2.6.8.1, the file nls_ascii.c uses an incorrect table size, allowing attackers to cause a buffer overflow and trigger a denial of service (kernel crash).
The vulnerability allows remote PHP code execution by injecting a remote file via the 'name' parameter in the 'article' mode of modules.php in SocialMPN. An attacker can send malicious code from an external server.
Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address, which is not properly handled when printing the header.
Unknown vulnerability in HTTP Anti Virus Proxy (HAVP) before version 0.51 prevents proper detection of viruses in certain files such as .CAB or .ZIP files.
Format string vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via format string specifiers in a command.
Vulnerability in xloadimage before version 4.1-r2 and xli before version 1.17 allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
Multiple vulnerabilities in xli before version 1.17 due to buffer management errors when processing image properties, some related to integer overflows in PPM files, may allow remote attackers to execute arbitrary code.
A format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the USER command.
Buffer overflow vulnerability in Trillian 3.0 and Pro 3.0 allows remote attackers to execute arbitrary code via a crafted PNG image file.
A vulnerability in the scan.c file of the LibXPM library may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.
A format string vulnerability in the log functions of dhcpd in version 2.x allows remote DNS servers to execute arbitrary code via specially crafted DNS messages. This is a different vulnerability than CVE-2002-0702.
Vulnerability in iCal before version 1.5.4 on Mac OS X 10.2.3 and later versions does not alert the user when handling calendars that use alarms, allowing attackers to execute programs and send email via alarms.