CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) versions 2.6.0 through 2.6.5 allows remote attackers to execute arbitrary code via a long URL.
SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to inject SQL code via the gid parameter, potentially leading to privilege escalation or unauthorized database operations.
PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php.
The Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy.
The vulnerability in smbmnt in Samba 2.x and 3.x on Linux 2.6 allows local users to gain root privileges by mounting a Samba share that contains a setuid root program.
DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writable removable media, which may lead to handling issues.
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, causing Squid to use only a portion of the requested URL when comparing it against the access control lists.
In Calife versions 2.8.5 and earlier, a heap-based buffer overflow may allow local users to execute arbitrary code via a long password.
CVE-2004-0159 in hsftp 1.11 has a format string vulnerability that allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an 'ls' command.
Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM) affects certain versions of RealSecure and BlackICE products. Remote attackers can execute arbitrary code by sending an SMB packet containing an authentication request with a long username.
Unknown vulnerability in CoreFoundation for Mac OS X 10.3.2, related to 'notification logging.'
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10 could allow local users to execute arbitrary code via a long filename if ltrace is installed setuid.
The login page of cPanel 9.1.0 (and possibly other versions) allows a remote attacker to execute arbitrary code by injecting shell metacharacters in the 'user' parameter.
The 'Allow cPanel users to reset their password via email' feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.
Multiple integer overflows in the Microsoft ASN.1 library (MSASN1.DLL) can lead to arbitrary code execution by remote attackers. The issue affects Windows NT 4.0, 2000, and XP, where vulnerabilities exist in LSASS.EXE, CRYPT32.DLL, and other components.
CVE-2004-0128 describes a vulnerability in the GEDCOM configuration script for phpGedView version 2.65.1 and earlier, allowing remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to point to a URL containing a malicious theme.php script.
Buffer overflow in the Extract Info Field Function for MSN and YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server. Examples include using the GLOBALS[rootdp] parameter in db.php and the GLOBALS[language_home] parameter in archivednews.php with a malicious version of lang_admin.php.
Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.