CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in HP HTTP Server versions 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
BEA WebLogic Server and WebLogic Express versions 8.1 SP3 and earlier, and 7.0 SP5 and earlier, improperly constrain a slash (/) servlet root URL pattern. This could allow a remote attacker to bypass intended servlet protections.
In IBM DB2 8.1, shared memory sections and events have default read and write permissions for the Everyone group, allowing local users to gain unauthorized access, obtain sensitive information such as cleartext passwords, and cause a denial of service.
A vulnerability in BEA WebLogic Server and WebLogic Express causes the boot password to be stored in cleartext in the registry. A local user can read it and gain unauthorized administrative access.
A vulnerability in BEA WebLogic Server and WebLogic Express may inadvertently expose passwords in IIOP exception messages. When IIOP is used, a password can be included in an error message sent to a client or stored in a log file.
A vulnerability in util-vserver before version 0.30.208-1 and kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
A remote file inclusion vulnerability in Siteframe before version 3.2.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the LOCAL_PATH parameter in web/classes.php.
SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.
A buffer overflow vulnerability in MTink from the printer-filters-utils package allows local users to execute arbitrary code by setting a long HOME environment variable.
A vulnerability in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.
A vulnerability in NetBSD allows a local user to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials.
The vulnerability in ISS BlackIce 3.6, used in multiple products, involves a failure to drop privileges before launching help from the 'More Info' button in the 'Application Protection' dialog. This allows local users to execute arbitrary programs as SYSTEM.
An untrusted search path vulnerability (RPATH) in XnView 1.70 and NView 4.51 on Gentoo Linux allows local users to execute arbitrary code via a malicious library in the current working directory.
A stack-based buffer overflow in TUGZip 3.4.0.0 occurs when processing a long filename in an ARJ archive. Remote attackers can exploit this to execute arbitrary code.
A buffer overflow vulnerability exists in the reset_vars function in config/tc-crx.c of the GNU as (gas) assembler in GNU Binutils before July 14, 2005. This flaw can be exploited via a crafted .s file, potentially leading to unknown impacts.
The SISCO OSI stack for Windows, used in MMS-EASE 7.10 and earlier, AX-S4 MMS 5.01 and earlier, AX-S4 ICCP 3.0103 and earlier, and ICCP Toolkit for MMS-EASE 4.10 and earlier, allows remote attackers to cause a denial of service (process crash) via certain network traffic, as demonstrated using a Nessus scan.
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allows remote attackers to delete arbitrary files via a ZIP, UUE or TAR archive that contains a .. (dot dot) in the filename, which is not properly handled when generating a preview.
A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.