CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP '220' message reply.
Finjan Software SurfinGate versions 6.0 and 6.0 1 allow remote attackers to bypass URL access restrictions by using an IP address instead of a hostname.
Heap-based buffer overflow in Floositek FTGate Pro 1.05 and FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command.
PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter.
User-mode Linux (UML) version 2.4.17-8 does not restrict access to kernel address space, allowing local users to execute arbitrary code.
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1, does not prepend a '/' character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.
SQL injection vulnerability in Mailidx before version 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.
site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
Gordano Messaging Server (GMS) Mail 8 only filters email messages for the first recipient, allowing remote attackers to bypass JUCE filters by sending a message to more than one user on the GMS server.
Buffer overflow in hotfoon4.exe in Hotfoon 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL containing a long voice phone number.
The vulnerability in sastcpd in SAS/Base 8.0 may allow local users to gain elevated privileges by setting the netencralg environment variable, leading to a segmentation fault.
Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call.
osCommerce 2.1 has a remote file inclusion vulnerability in include_once.php that allows remote attackers to execute arbitrary PHP code via the include_file parameter.
Sun Ray Server Software (SRSS) version 1.3, when Non-Smartcard Mobility (NSCM) is enabled, allows remote attackers to login as another user by running dtlogin from a system that supports the XDMCP client.
The cvsupd.sh script in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out.
The default configuration of Xerox DocuTech 6110 and 6115 running Solaris 8.0 has a large number of unnecessary services enabled, such as RPC and sprayd, which could allow remote attackers to obtain access to the device.
The RPC module in Webmin versions 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.
The irssi IRC client version 0.8.4, downloaded after March 14, 2002, may contain a backdoor in the configuration file, allowing remote attackers to access the system.
Perlbot 1.0 beta allows remote attackers to execute arbitrary commands via shell metacharacters in (1) a word that is being spell checked or (2) an e-mail address.
search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.