CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.15)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W Eudora Worldmail, prawdopodobnie w wersji 6.1.22.0, występuje wiele przepełnień bufora, które mają nieznany wpływ i wektory ataku. Problemy te zostały zademonstrowane przez moduły 'Eudora WorldMail stack overflow' oraz 'Eudora WorldMail heap overflow' w pakiecie VulnDisco.
Wersja 2.0.1 J-Pierre DEZELUS Les Visiteurs zawiera podatność na zdalne włączenie pliku w pliku common/visiteurs/include/library.inc.php. Umożliwia to zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrze lvc_modules_dir.
W podatności CVE-2006-5610 występuje luka w zdalnym dołączaniu plików w pliku player/includes/common.php w Teake Nutma Foing, zmodyfikowanym w Fully Modded phpBB (phpbbfm) 2021.4.40. Umożliwia to zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrze phpbb_root_path.
Podatność typu SQL injection w pliku pop_mail.asp w Snitz Forums 2000 w wersji 3.4.06 pozwala zdalnym atakującym na wykonywanie dowolnych poleceń SQL za pomocą parametru RC. Źródło tej informacji jest nieznane, a szczegóły pochodzą z informacji od osób trzecich.
Wielokrotne podatności na zdalne włączenie pliku PHP w redgun RedBLoG 0.5 umożliwiają zdalnym atakującym wykonanie dowolnego kodu PHP poprzez URL w parametrach root w imgen.php oraz root_path w admin/config.php, common.php i admin/index.php.
Wielokrotne nieokreślone podatności w Paisterist Simple HTTP Scanner (sHTTPScanner) przed wersją 0.4 mogą prowadzić do nieznanego wpływu i wektorów ataku.
Wersja 1.1.5 Jupiter CMS zawiera podatność na zdalne dołączanie plików w pliku index.php, co pozwala zdalnym atakującym na wykonanie dowolnego kodu PHP poprzez URL w parametrze template. Istnieją jednak wątpliwości co do tej podatności, ponieważ zmienna $template jest definiowana jako statyczna przed jej użyciem w instrukcji include.
Multiple PHP remote file inclusion vulnerabilities exist in the lmtg_myhomepage Component (com_lmtg_myhomepage) for Mambo. A remote attacker can execute arbitrary PHP code by manipulating the mosConfig_absolute_path parameter in install.lmtg_homepage.php and mtg_homepage.php. The issue has been disputed by a third party, who states that the variable is only used within a function definition; CVE source code analysis on 20060824 is not conclusive but tends to concur with the dispute.
Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL in the DIR_LIBS parameter in action.php, media.php, xmlrpc/server.php, and xmlrpc/api_metaweblog.inc.php. This is similar to CVE-2006-2583, but the issue has been disputed by third parties who state that DIR_LIBS is defined in an include file before use.
SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1 allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when settings specify only "Search in Detailed description" and "Search also in ISBN." The vendor disputed this issue, claiming the bug does not pose a security threat.
The vulnerability in admin_news.php in Archilles Newsworld up to version 1.3.0 allows attackers to bypass authentication by obtaining the password hash of another user (e.g., through another Newsworld vulnerability) and specifying it in the pwd argument.
A stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.
Vulnerability in HP OpenView Network Node Manager versions 6.2 through 7.50 allows remote attackers to execute arbitrary system commands by injecting shell metacharacters into the node, cdpView, freeIPaddrs, or ecscmg parameters in .ovpl scripts.
In Gaim before version 1.5.0, a buffer overflow exists in the AIM and ICQ module. A remote attacker can exploit an away message containing a large number of AIM substitution strings (e.g., %t or %n), causing an application crash and potentially arbitrary code execution.
A double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.
Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through Service Pack 5 fails to log out users when an application is redeployed, allowing continued access without re-authentication, potentially violating updated security constraints or role mappings.
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
In GNUBoard 3.40 and earlier, the file extension check only verifies extensions that contain all lowercase letters, allowing remote attackers to upload arbitrary files via file extensions that include uppercase letters.
Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MODE line that causes an incorrect length calculation, which leads to a buffer overflow.
Integer overflow in the readpgm function in pnm.c for GOCR 0.40, when using the netpbm library, allows remote attackers to execute arbitrary code via a PNM file with large width and height values, which leads to a heap-based buffer overflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS