CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WikkiTikkiTavi versions before 0.21 have a PHP remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the TemplateDir variable.
PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to backend.php, screen.php, or admin/modules/comment.php.
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
Buffer overflow in axspawn.c in Axspawn-pam before version 0.2.1a allows remote attackers to execute arbitrary code via large packets.
The graph.php file in Ganglia PHP RRD Web Client version 1.0.2 has a vulnerability that allows remote attackers to execute arbitrary commands via the command parameter passed to the passthru function.
Buffer overflow in the IRC module of Trillian 0.725 and 0.73 allows remote attackers to execute arbitrary code via a long DCC Chat message.
Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response.
SQL injection vulnerability in 123tkShop before version 0.3.1 allows remote attackers to execute arbitrary SQL queries via various programs, including function_describe_item1.inc.php.
phpShare versions before 0.6 beta 3 allow remote attackers to include and execute arbitrary PHP scripts from remote servers.
Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack.
CVE-2002-2200 affects Benjamin Lefevre Dobermann FORUM version 0.5 and earlier, allowing remote attackers to remotely include and execute malicious PHP files via the 'subpath' variable in entete.php, enteteacceuil.php, index.php, or newtopic.php.
Unspecified security vulnerability in Baby FTP Server versions before November 7, 2002, with unknown impact and attack vectors.
Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.
The awp_log function in apt-www-proxy 0.1 has a format string vulnerability that allows remote attackers to execute arbitrary code.
Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.
Mambo Site Server 4.0.11 installs with a default username and password of 'admin', which allows remote attackers to gain privileges.
MyPHPLinks versions 2.1.9 and 2.2.0 have an SQL injection vulnerability in admin/auth/checksession.php that allows remote attackers to execute arbitrary SQL commands via the idsession parameter.
KaZaA Media Desktop version 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages.
Cisco IOS versions 11.2.x and 12.0.x does not limit the size of its redirect table, allowing remote attackers to cause a denial of service (memory consumption) via spoofed ICMP redirect packets sent to the router.