CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value.
SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter.
L-Forum 2.40 and earlier has a cross-site scripting vulnerability when the 'Enable HTML in messages' option is off. This allows remote attackers to insert arbitrary scripts or HTML via message fields including 'From', 'E-Mail', and 'Subject'.
L-Forum versions 2.40 and earlier have a cross-site scripting (XSS) vulnerability when the 'Enable HTML in messages' option is enabled. This allows remote attackers to inject arbitrary scripts or HTML via message fields such as 'From', 'E-Mail', 'Subject', and 'Body'.
Web Shop Manager version 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box.
Symantec Raptor Firewalls and other listed models generate easily predictable initial sequence numbers (ISN), allowing remote attackers to spoof connections.
SQL injection vulnerability in ttForum allows remote attackers to execute arbitrary SQL and gain ttForum Administrator privileges via the Ignorelist-Textfield argument in the Preferences page.
EPIC IRC Client (EPIC4) versions pre2.002, pre2.003, and possibly later versions allow remote malicious IRC servers to cause a denial of service (crash) and potentially execute arbitrary code via a CTCP request from a large nickname, leading to incorrect length calculation.
Multiple buffer overflows in ircII 20020912 allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via responses that are not properly fed to the my_strcat function by ctcp_buffer, cannot_join_channel, status_make_printable, create_server_list, and possibly other functions.
Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via various dissectors.
The header.php file in ttCMS version 2.3 and earlier allows remote attackers to inject arbitrary PHP code by setting the ttcms_user_admin parameter to '1' and modifying the admin_root parameter to point to a URL containing a malicious header.inc.php script.
Internet Explorer versions 5.01, 5.5, and 6.0 allow remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// requests, leading to multiple file download dialogs being opened.
IPSec in Mac OS X before version 10.2.6 does not properly handle certain incoming security policies that match by port. This could allow traffic that is not explicitly allowed by the policies.
The FrontRange GoldMine mail agent in versions 5.70 and 6.00 before 30503 directly sends HTML to the default browser without setting its security zone or labeling it untrusted. This allows remote attackers to execute arbitrary code via a message rendered in IE using a less secure zone.
Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges.
Integer signedness errors in the POP3 client for Mirabilis ICQ Pro 2003a allow remote attackers to execute arbitrary code via the (1) Subject or (2) Date headers.
The admin.php file in miniPortail allows remote attackers to gain administrative privileges by setting the miniPortailAdmin cookie to an 'adminok' value.
Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client versions 3.5.x through 4.0.REL, when enabling IPSec over TCP for a port, allow remote attackers to access the private network without authentication.
The key validation code in GnuPG before version 1.2.2 improperly assesses the validity of keys with multiple user IDs, assigning the highest validity to the most valid user ID. This prevents GnuPG from warning the encrypting user when a user ID lacks a trusted path.
Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value.