CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WebBrowser ActiveX control or the MSHTML rendering engine in Internet Explorer 6 allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute JavaScript, as demonstrated via delayed HTTP redirects with a Location header containing a "URL:" prefix before a "ms-its" protocol URI, or by modifying the window's location attribute.
The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.
The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as proftpdvhosts or addalink.cgi. This is a different vulnerability than CVE-2004-0490.
A buffer overflow vulnerability in the ntlm_check_auth (NTLM authentication) function of Squid Web Proxy Cache versions 2.5.x and 3.x, compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).
Integer overflow in the hpsb_alloc_packet function in the IEEE 1394 (Firewire) driver for Linux kernels 2.4 and 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via the functions raw1394_write, state_connected, handle_remote_request, or hpsb_make_writebpacket.
Vulnerability in page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.
Buffer overflow vulnerability in the TranslateFilename function in common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.
Vulnerability in RSBAC 1.2.2-1.2.3 allows local users to access sys_creat, sys_open, and sys_mknod functions inside jails, potentially leading to privilege escalation.
Vulnerability in comersus_gatewayPayPal.asp in Comersus Cart 5.09 (and earlier versions before 5.098) allows remote attackers to change item prices by directly modifying them in the URL.
Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbitrary files via .. (dot dot) and // (double slash) sequences in the filename parameter.
The Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access.
Heap-based buffer overflow in proxy_util.c of mod_proxy in Apache 1.3.25 to 1.3.31. A remote attacker can send an HTTP Content-Length header with a negative value, causing large data copying and leading to process crash or potential arbitrary code execution.
CVS versions from 1.11.x to 1.11.16 and from 1.12.x to 1.12.8 improperly handle empty data lines, which may allow remote attackers to perform an out-of-bounds write. This can lead to arbitrary code execution or modification of critical program data.
A vulnerability in the 'memory dump' command in the VICE emulator versions 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and potentially execute arbitrary code via format string specifiers in an output string.
CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16 do not properly handle malformed 'Entry' lines. This may lead to a NULL terminator not being used, resulting in a denial of service (crash), modification of critical program data, or arbitrary code execution.
The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly leading to a buffer overflow.
A stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0 allows local or remote attackers to execute arbitrary code via a .job file containing long parameters.
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10 allows remote attackers to read and delete arbitrary files via '..' sequences in the dynamicimag argument to crystalimagehandler.aspx.
The syssgi SGI_IOPROBE system call in IRIX 6.5.20 through 6.5.24 allows local users to gain privileges by reading and writing to kernel memory.
The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.