CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.
A vulnerability in KnowledgeBuilder (KnowledgeBase) allows remote attackers to execute arbitrary PHP code by modifying the 'page' parameter to reference a URL on a remote web server containing the code.
The exit.c file in Linux kernel 2.6-test9-CVS was modified to contain a backdoor, allowing local users to elevate their privileges by passing __WCLONE|__WALL to the sys_wait4 function.
KPopup 0.9.1 has a vulnerability related to trusting the PATH variable when executing the killall command. This allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.
CVE-2003-1171 involves a heap-based buffer overflow in the sec_filter_out function in mod_security versions 1.7RC1 through 1.7.1 in Apache 2. This allows remote attackers to execute arbitrary code via a server-side script that sends a large amount of data.
Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long AUTH command to the POP3 server or AUTHENTICATE command to the IMAP server.
A PHP remote file inclusion vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
Buffer overflow in the prepare_reply function in request.c for Mathopd versions 1.2 through 1.5b13, and possibly earlier, allows remote attackers to cause a denial of service (server crash) and potentially execute arbitrary code via an HTTP request with a long path.
X509TrustManager in Java Secure Socket Extension (JSSE) incorrectly calls the isClientTrusted method when determining server trust, leading to improper validation of digital certificates.
Pedestal Software Integrity Protection Driver (IPD) version 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel. Attackers can use the NtCreateSymbolicLinkObject function to create a symbolic link to physical memory or a drive letter.
CVE-2003-1244 describes an SQL injection vulnerability in page_header.php in phpBB versions 2.0, 2.0.1, and 2.0.2. It allows remote attackers to brute force user passwords, potentially gaining unauthorized access to forums.
PHP remote file inclusion vulnerability in hit.php for Kietu versions 2.0 and 2.3 allows remote attackers to execute arbitrary PHP code via the url_hit parameter.
Buffer overflow in Siemens 45 series mobile phones allows remote attackers to cause a denial of service via a Short Message Service (SMS) message with a long image name.
Unspecified vulnerability in Phorum versions 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.
The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges.
The SIP implementation in multiple Cisco products, including IP Phone models 7940 and 7960 and IOS versions in the 12.2 train, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages.
The SIP implementation in multiple dynamicsoft products, including demo products for AppEngine, allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages.
The SIP implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages.
The SIP implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages.
Buffer overflow in RealSystem Server 6.x, 7.x, and 8.x, and RealSystem Proxy 8.x, related to URL error handling, allows remote attackers to cause a denial of service and possibly execute arbitrary code.