CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in the get_field_headers function in csv2xml.cpp of csv2xml version 0.5.1. A remote attacker can exploit a crafted CSV file to execute arbitrary code.
An integer overflow in libtiff versions 3.5.7 and 3.7.0 in tif_dirread.c and tif_fax3.c allows remote attackers to execute arbitrary code via a crafted TIFF file with a TIFF_ASCII or TIFF_UNDEFINED directory entry having an entry count of -1, leading to a heap-based buffer overflow.
Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before version 2.3.2.97, used in CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, and possibly other applications, allows remote attackers to execute arbitrary code via a long filename.
Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file.
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an integer overflow/underflow in the pack function, or (3) an integer overflow/underflow in the unpack function.
Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.
A buffer overflow vulnerability in the Microsoft W3Who ISAPI (w3who.dll) allows a remote attacker to cause a denial of service and potentially execute arbitrary code by sending a long query string.
The vulnerability in Opera 7.x up to version 7.54 allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability.
A vulnerability in Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability, a different vulnerability than CVE-2004-1122.
Vulnerability in VIM and gVIM before version 6.3 allows local users to execute arbitrary commands by opening a file containing a crafted modeline. The attack uses options such as termcap, printdevice, titleold, filetype, syntax, backupext, keymap, patchmode, or langmenu.
Multiple integer overflows in zgv 5.8 image reading functions (BMP, GIF, PNG, TIFF, etc.) allow remote code execution via crafted image headers that cause buffer overflows.
Buffer overflow in the auto_filter_extern function in auto.c for NapShare 1.2, with the extern filter enabled, allows remote attackers to execute arbitrary code via a crafted gnutella response.
Buffer overflow vulnerability in the put_words function in subs.c of abcm2ps version 3.7.20. A remote attacker can execute arbitrary code via crafted ABC files.
SQL injection vulnerability in fdelmail.asp, addressc.asp, and possibly postmail.asp and fmvmail.asp in CMailServer 5.2 allows remote attackers to inject arbitrary SQL commands via the indexOfMail parameter, enabling deletion of email metadata or contact addresses.
A buffer overflow vulnerability in the strexpand function in string.c in LinPopUp 1.2.0 allows remote attackers to execute arbitrary code via a crafted message that is not properly handled during a Reply operation.
Vulnerability in Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via a crafted ftp:// URL containing a URL-encoded newline (%0a) before the FTP command, causing command injection into the FTP session, as demonstrated with a PORT command.
The vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.
Buffer overflow in the get_header function in asf_mmst_streaming.c in MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a crafted ASF video stream.
A buffer overflow in the Mesh::type method in mesh.c of the mview program in Mesh Viewer 0.2.2 allows remote attackers to execute arbitrary code via crafted mesh files.