CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the readpgm function in pnm.c for GOCR 0.40, when using the netpbm library, allows remote attackers to execute arbitrary code via a PNM file with large width and height values, which leads to a heap-based buffer overflow.
Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system and possibly execute arbitrary commands.
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the hard-coded string 'boogaadeeboo'.
Integer overflow in Evolution 2.0.2 and earlier, in the camel-lock-helper component, allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, leading to a zero byte memory allocation and a buffer overflow.
Mbedthis AppWeb HTTP server before version 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.
The vulnerability in CUPS before version 1.1.21rc1 is that the Location directive in cupsd.conf is treated as case sensitive. This allows attackers to bypass intended ACLs by using a printer name containing uppercase or lowercase letters different from those specified in the directive.
All three applications: AllMyVisitors, AllMyLinks, and AllMyGuests have a PHP remote file inclusion vulnerability in include/footer.inc.php. An attacker can execute arbitrary PHP code by exploiting the _AMVconfig[cfg_serverpath] parameter.
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a backslash (\) or encoded backslash (%5C).
Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.
Buffer overflow vulnerability in extproc component in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allow remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.
k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, leading to a heap-based buffer overflow.
Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code. These issues involve both octal encoding and quoted-printable encoding.
A PHP remote file inclusion vulnerability in PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server containing the code.
Pedestal Software Integrity Protection Driver (IPD) version 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel. Attackers can use the NtCreateSymbolicLinkObject function to create a symbolic link to physical memory or a drive letter.
A double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.
Buffer overflow in the defang function in libhttpd.c for thttpd versions 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests containing '<' or '>' characters, which trigger the overflow when the characters are expanded to '<' and '>' sequences.
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.
An off-by-one error in the fb_realpath() function may allow attackers to execute arbitrary code. The issue affects wu-ftpd versions 2.5.0 to 2.6.2 when commands cause pathnames to exceed MAXPATHLEN, leading to a buffer overflow.
Off-by-one error in the xlog function of mountd in the nfs-utils package before version 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.