CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WebSphere Application Server 5.0.2 and earlier versions store admin and LDAP passwords in plaintext in FFDC logs upon failed login attempts, allowing attackers to gain privileges.
An unspecified vulnerability in IBM WebSphere Application Server versions 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5, and 6.0.2.7 related to HTTP request handlers. Remote attackers can exploit this flaw, but the impact details are unknown.
IBM WebSphere Application Server versions 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7 records user credentials in plaintext in the addNode.log file. This allows attackers to gain privileges.
A directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitrary files by using an encoded drive letter (C:%5C) in a URL.
In Raydium SVN revision 312 and earlier, the raydium_network_read function in network.c contains a buffer overflow. A remote attacker can send packets with long global variables to the client, allowing arbitrary code execution.
Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged using the raydium_log function in log.c or the raydium_console_line_add function in console.c, possibly from a long player name.
A stack-based buffer overflow exists in the WeOnlyDo wodSSHServer ActiveX Component versions 1.2.7 and 1.3.3 DEMO, also used in FreeSSHd 1.0.9 and freeFTPd 1.0.10. Remote attackers can exploit a long key exchange algorithm string to execute arbitrary code.
A buffer overflow vulnerability in EMC Retrospect Client versions 5.1 through 7.5 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a crafted packet to port 497.
In Outgun 1.0.3 bot 2 and earlier, the leetnet functions (leetnet/rudp.cpp) contain a buffer over-read vulnerability. A remote attacker can send packets with incorrect message sizes, causing an application crash (denial of service).
A stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a data_file_request command with a long type or name string.
In Outgun 1.0.3 bot 2 and earlier, the leetnet functions (leetnet/rudp.cpp) improperly handle large packets, allowing a remote attacker to cause an exception and interrupt the game (denial of service).
A buffer overflow vulnerability in FileZilla before version 2.2.23 allows remote attackers to execute arbitrary code via unknown attack vectors.
A buffer overflow vulnerability was found in the getsym function in tekhex.c of libbfd in GNU Binutils before 20060423, as used by GNU strings. This allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Tektronix Hex Format (TekHex) record where the length character is not a valid hexadecimal character.
SQL injection vulnerability in charts.php of the Chart mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
A PHP remote file inclusion vulnerability exists in pafiledb_constants.php within the Download Manager (mxBB pafiledb) integration used with phpBB. Attackers can exploit the module_root_path parameter to execute arbitrary PHP code remotely.
RealVNC 4.1.1 and other products using it (e.g., AdderLink IP, Cisco CallManager) allow a remote attacker to bypass authentication by sending a request with an insecure security type ("Type 1 - None"), which is accepted even if not offered by the server. The attack was originally demonstrated using a long password.
A vulnerability in QuickTime Streaming Server on Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) by sending a QuickTime movie with a missing track, triggering a null pointer dereference.
In Apple Mac OS X 10.3.9 and 10.4.6, the Mail application contains an integer overflow when processing MacMIME encapsulated attachments. A remote attacker can exploit this vulnerability to execute arbitrary code via a crafted attachment.
An integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding.
In Apple Mac OS X 10.3.9 and 10.4.6, the bundle API in CoreFoundation loads dynamic libraries even if the client application has not directly requested it. This allows attackers to execute arbitrary code from an untrusted bundle.