CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.
Buffer overflow vulnerability in the IsValidFile function of the ADM ActiveX control in Altnet Download Manager 4.0.0.4 and earlier, used in Kazaa Media Desktop 1.3–2.6.4 and Grokkster 1.3–2.6, allows remote attackers to execute arbitrary code via a long bstrFilepath parameter.
Unknown vulnerability in IlohaMail before version 0.8.14-rc1 has unknown impact and attack vectors.
Vulnerability in Axis Network Camera version 2.40 and earlier, and Axis Video Server version 3.12 and earlier, allows remote attackers to execute arbitrary commands by sending an accent (`) or other shell metacharacters in the query string to virtualinput.cgi.
WebCalendar allows remote attackers to gain privileges by modifying critical parameters to view_entry.php or upcoming.php.
The vulnerability in AppServ 2.5.x and earlier versions consists of a default username and password, allowing remote attackers to gain access to the system.
Vulnerability in SecureCRT 4.0, 4.1, and possibly other versions allows remote attackers to execute arbitrary commands via a telnet:// URL using the /F option to specify a configuration file on a Samba share.
The vulnerability in JRun 4.0 involves improper generation and handling of the JSESSIONID, allowing a remote attacker to perform a session fixation attack and hijack a user's HTTP session.
Unknown vulnerability in the PageEditor component in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.
Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as revert and delete.
A buffer overflow vulnerability in BlackJumboDog 3.x FTP server allows remote attackers to execute arbitrary code by sending long FTP commands such as USER, PASS, RETR, CWD, XMKD, and XRMD.
SQL injection vulnerability in the show_stats module in Arcade.php in IbProArcade allows remote attackers to execute arbitrary SQL code via the gameid parameter.
The Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, improperly handles files with multiple extensions such as .php.rar, allowing remote attackers to upload and execute arbitrary code.
The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.
Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.
Unknown vulnerability in the 32bit emulation code in Linux 2.4 on AMD64 systems allows local users to gain privileges.
Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrary code via a crafted BMP file.
An unknown vulnerability in Apache 2.0.51 prevents the merging of the Satisfy directive, which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
A buffer overflow vulnerability in the uustat utility in Sun Solaris 8 and 9 allows local users to execute arbitrary code by providing a long -S command line argument.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS