CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Opera 7.51 for Windows and 7.50 for Linux allows a frame from one domain to inject content into a frame belonging to another domain. This issue can be exploited for website spoofing and other attacks.
The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.
A buffer overflow vulnerability in Whisper FTP Surfer 1.0.7 allows remote FTP servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long filename.
Integer overflow in imgbmp.cxx in Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.
The vulnerability in HP OpenView Select Access versions 5.0 through 6.0 is due to incorrect decoding of UTF-8 encoded Unicode characters in a URL. This allows a remote attacker to bypass access restrictions.
SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
Konqueror versions 3.1.3, 3.2.2, and possibly others do not properly prevent a frame in one domain from injecting content into a frame belonging to another domain, enabling web site spoofing and other attacks, known as the frame injection vulnerability.
The vulnerability in Internet Explorer for Mac 5.2.3 and Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain. This facilitates web site spoofing and other attacks, known as the frame injection vulnerability.
Vulnerability in Sun Java System Portal Server 6.2 allows remote authenticated users to obtain Calendar Server privileges and modify Calendar data by changing the display options to a non-default view.
The vulnerability in Safari 1.2.2 allows a frame from one domain to inject content into a frame belonging to another domain. This issue, known as the frame injection vulnerability, can be exploited for website spoofing and other attacks.
A format string vulnerability in OllyDbg 1.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers directly provided to the OutputDebugString function call.
Vulnerability in Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the 'page' parameter.
Buffer overflow in Medal of Honor: Allied Assault 1.11v9 and earlier, Breakthrough 2.40b and earlier, and Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as the getinfo query, the connect packet, and other unknown vectors.
Adobe Reader 6.0 improperly handles null characters when splitting a filename path into components, allowing a remote attacker to execute arbitrary code via a file with a long extension not normally handled by Reader, triggering a buffer overflow.
A buffer overflow vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.
A double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause an application crash via a malformed GIF image.
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allow remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.
PHP remote file inclusion vulnerability in index.php in EasyIns Stadtportal 4 allows remote attackers to execute arbitrary PHP code via the site parameter.
Unknown vulnerability in libtasn1 in versions 0.1.x before 0.1.2 and 0.2.x before 0.2.7, related to DER parsing functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS