CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote attackers to execute arbitrary code via a large image filename.
A buffer overflow vulnerability in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long password field in a join request.
Vulnerability in a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.
Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code via a long Overwrite header.
Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in title or baseurl fields.
phpMyAdmin versions 2.6.0-pl2 and earlier before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
A stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05 (and possibly 5.06) allows remote attackers to execute arbitrary code via a crafted .m3u playlist file.
The init scripts in Search for Extraterrestrial Intelligence (SETI) project 3.08-r3 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.
Vulnerability in the Archive::Zip Perl module before version 1.14, used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
The binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 improperly handles a failed call to the mmap function, resulting in an incorrect mapped image. A local user can exploit this vulnerability to execute arbitrary code.
Vulnerability in PHP 4.x up to 4.3.9 and PHP 5.x up to 5.0.2, running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended directory by using shell metacharacters in the current directory name.
Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.
Buffer overflow vulnerability in hpsockd before version 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.
A buffer overflow in the find_next_file function in playlist.c of mpg123 0.59r allows remote attackers to execute arbitrary code via a crafted MP3 playlist.
Buffer overflow vulnerability in the switch_voice function in parse.c of jcabc2ps 20040902 allows remote attackers to execute arbitrary code via a crafted ABC file.
The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption.
The vulnerability in rquotad (rquota_server.c) in nfs-utils before version 1.0.6-r6 on 64-bit architectures is due to improper integer conversion, leading to a stack-based buffer overflow. A remote attacker can execute arbitrary code via a crafted NFS request.
The vulnerability in the changepassword.cgi script of ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious 'make' program.
The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.
The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.