CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary configuration file by starting an suid process and pointing the fcronsighup configuration file to a /proc entry that is owned by root but modifiable by the user, such as /proc/self/cmdline or /proc/self/environ.
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.
Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.
A heap-based buffer overflow in server.cpp of WebMod 0.47 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a POST request with a Content-Length header smaller than the actual data sent.
The vulnerability in bsmtpd 2.3 and earlier versions is due to improper sanitization of email addresses, allowing a remote attacker to execute arbitrary commands.
Vulnerability in ArGoSoft FTP Server before version 1.4.2.8 allows remote attackers to read arbitrary files via shortcut (.LNK) files in the SITE COPY command. This is a different vulnerability than CVE-2005-0519.
A vulnerability in the ImageGalleryPlugin (ImageGalleryPlugin.pm) for Twiki allows a remote attacker to execute arbitrary system commands via specially crafted thumbnail generation commands.
Cross-Site Request Forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.
Multiple SQL injection vulnerabilities in page.php for iGeneric (iG) Shop 1.2 allow remote attackers to execute arbitrary SQL statements via the cats, l_price, or u_price parameters.
Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system and possibly execute arbitrary commands.
PHP remote file inclusion vulnerability in Tar.php of Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
Multiple integer overflows in the sftp_pkt_getstring and fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56 and earlier allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory allocation.
Vulnerability in misc.php in vBulletin 3.0.6 and earlier, when 'Add Template Name in HTML Comments' is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
The RgSecurity form in the HTTP server of the Thomson TCW690 cable modem (firmware 2.1, software ST42.03.0a) allows an attacker on the LAN to change the password without proper validation via a direct POST request.
PHP remote file inclusion vulnerability in mail_autocheck.php of the Email This Entry add-on for pMachine Pro 2.4 (and possibly other versions including pMachine Free). An attacker can directly request mail_autocheck.php and modify the pm_path parameter to reference a URL on a remote server containing malicious PHP code, leading to its execution.
Vulnerability in ArGoSoft FTP Server before version 1.4.2.7 allows remote attackers to read arbitrary files on the server. The attack involves uploading a ZIP archive containing a shortcut (.LNK) file, then using the SITE UNZIP command to extract it on the server and accessing the file.
Directory traversal vulnerability in CitrusDB 0.3.6 and earlier allows remote and local attackers to include arbitrary PHP files via '..' sequences in the 'load' parameter in index.php.
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the hard-coded string 'boogaadeeboo'.
Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.
A buffer overflow vulnerability exists in Microsoft Word 2002 (version 10.6612.6714) SP3, and possibly other versions. A remote attacker can exploit a specially crafted .doc file containing unexpected values, such as an offset triggering out-of-bounds memory access or a value causing a large memory copy due to an integer conversion error, leading to application crash and potentially arbitrary code execution in winword.exe.