CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Opera 7.51 for Windows and 7.50 for Linux allows a frame from one domain to inject content into a frame belonging to another domain. This issue can be exploited for website spoofing and other attacks.
The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.
MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.
Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long FTP command.
Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
Konqueror versions 3.1.3, 3.2.2, and possibly others do not properly prevent a frame in one domain from injecting content into a frame belonging to another domain, enabling web site spoofing and other attacks, known as the frame injection vulnerability.
Vulnerability in Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the 'page' parameter.
Vulnerability in Sun Java System Portal Server 6.2 allows remote authenticated users to obtain Calendar Server privileges and modify Calendar data by changing the display options to a non-default view.
SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
The vulnerability in Safari 1.2.2 allows a frame from one domain to inject content into a frame belonging to another domain. This issue, known as the frame injection vulnerability, can be exploited for website spoofing and other attacks.
Buffer overflow in Medal of Honor: Allied Assault 1.11v9 and earlier, Breakthrough 2.40b and earlier, and Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as the getinfo query, the connect packet, and other unknown vectors.
The vulnerability in Internet Explorer for Mac 5.2.3 and Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain. This facilitates web site spoofing and other attacks, known as the frame injection vulnerability.
A format string vulnerability in OllyDbg 1.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers directly provided to the OutputDebugString function call.
The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
The vulnerability in HP OpenView Select Access versions 5.0 through 6.0 is due to incorrect decoding of UTF-8 encoded Unicode characters in a URL. This allows a remote attacker to bypass access restrictions.
Integer overflow in imgbmp.cxx in Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.
A buffer overflow vulnerability in Whisper FTP Surfer 1.0.7 allows remote FTP servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long filename.
Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.
A double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause an application crash via a malformed GIF image.
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allow remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.