CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.
Vulnerability in fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary configuration file by starting an suid process and pointing the fcronsighup configuration file to a /proc entry that is owned by root but modifiable by the user, such as /proc/self/cmdline or /proc/self/environ.
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
Multiple buffer overflows in libXML versions 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via a long FTP URL, a long proxy URL containing FTP data, and other overflows related to manipulation of DNS length values.
Integer overflow in fetch on FreeBSD 4.1 through 5.3 allows remote malicious servers to execute arbitrary code via certain HTTP headers in an HTTP response, which lead to a buffer overflow.
A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function.
Vulnerability in sudo before version 1.6.8p2 allows local users to execute arbitrary commands by using '()' style environment variables to create functions with the same name as any program called within a bash script without using the full pathname.
Integer underflow in pppd (ppp 2.4.1) in cbcp.c allows a remote attacker to cause a denial of service (daemon crash) by sending a CBCP packet with an invalid length value, leading to access of an incorrect memory location.
Buffer overflow in the getnickuserhost function in BNC 2.8.9 (and possibly other versions) allows a remote IRC server to execute arbitrary code by sending a response containing many '!' or '@' characters.
Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.
Vulnerability in iCal before version 1.5.4 on Mac OS X 10.2.3 and later versions does not alert the user when handling calendars that use alarms, allowing attackers to execute programs and send email via alarms.
RaidenHTTPD 1.1.32 and possibly earlier versions before 1.1.34 contain a buffer overflow vulnerability. A remote attacker can exploit a long URL to execute arbitrary code on the server.
Format string vulnerability in the -a option (daemon mode) in Proxytunnel before 1.2.3 allows remote attackers to execute arbitrary code via format string specifiers in an invalid proxy answer.
A heap-based buffer overflow in server.cpp of WebMod 0.47 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a POST request with a Content-Length header smaller than the actual data sent.
The vulnerability in bsmtpd 2.3 and earlier versions is due to improper sanitization of email addresses, allowing a remote attacker to execute arbitrary commands.
A vulnerability in the ImageGalleryPlugin (ImageGalleryPlugin.pm) for Twiki allows a remote attacker to execute arbitrary system commands via specially crafted thumbnail generation commands.
Vulnerability in ArGoSoft FTP Server before version 1.4.2.8 allows remote attackers to read arbitrary files via shortcut (.LNK) files in the SITE COPY command. This is a different vulnerability than CVE-2005-0519.
Cross-Site Request Forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.