CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
An integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.
An unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".
A vulnerability in Mozilla Firefox, Thunderbird, Mozilla Suite, and SeaMonkey allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create JavaScript functions compiled with extra privileges.
A vulnerability in nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a 'particular sequence of HTML tags' leading to memory corruption.
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox's ForEach method.
An integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property, leading to a heap-based buffer overflow.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 contains a buffer overflow vulnerability. Remote attackers can cause a denial of service (crash) and possibly execute arbitrary code via crafted Cascading Style Sheets (CSS) that trigger an out-of-bounds array write.
An unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.
A vulnerability in Mozilla Firefox, Thunderbird, Mozilla Suite, and SeaMonkey allows remote attackers to execute arbitrary code via an invalid and nonsensical ordering of table-related tags, resulting in a negative array index.
A stack-based buffer overflow in Novell GroupWise Messenger before version 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An unspecified vulnerability in Firefox and Thunderbird before version 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.
An eval injection vulnerability in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the $method and $args parameters in pajax_call_dispatcher.php.
Adobe Document Server for Reader Extensions 6.0 lacks proper access control, allowing remote authenticated users to perform privileged actions by modifying the actionID and pageID parameters.
INDEXU 5.0.0 and 5.0.1 contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the theme_path parameter in 25 scripts and the base_path parameter in invoice.php to execute arbitrary PHP code.
In Debian GNU/Linux, during the configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, debconf uses the world-readable config.dat file instead of the restricted passwords.dat file to store the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, allowing local users to view the password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS