CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in the socket_getline function in Newspost 2.1.1 and earlier allows a remote malicious NNTP server to execute arbitrary code via a long string without a newline character.
WebWasher Classic versions 2.2.1 and 3.3, when running in server mode, improperly handle CONNECT requests to localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to upload arbitrary files via upload.php or read arbitrary files via download.php, and remote authenticated users to read, create, or delete arbitrary directories and files via IMAP commands CREATE, EXAMINE, SELECT, or DELETE.
A heap-based buffer overflow vulnerability in Apple QuickTime on Mac OS 10.2.8 through 10.3.5 allows remote attackers to execute arbitrary code via a specially crafted BMP image.
A vulnerability in the AFP server on Mac OS X 10.3.x through 10.3.5 allows a guest who has mounted an AFP volume to terminate authenticated user sessions by sending modified SessionDestroy packets.
Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.
Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.
Multiple integer overflows in xpdf 3.0 and other packages that use xpdf code such as CUPS allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.
Vulnerability in Kaspersky versions 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
Heap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled with the OJPEG_SUPPORT (old JPEG support) option, allows remote attackers to execute arbitrary code via a malformed TIFF image.
Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via the 'Send page' functionality, certain responses from a malicious POP3 server, or a link containing a non-ASCII hostname.
The libsasl and libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.
The vulnerability in SUSE Linux Enterprise Server 9 on the S/390 platform is due to improper handling of a certain privileged instruction, allowing local users to gain root privileges.
Buffer overflow vulnerability in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7. A remote attacker can exploit this flaw to execute arbitrary code by sending a specially crafted TRANSACT2_QFILEPATHINFO request with a small 'maximum data bytes' value.
A buffer overflow vulnerability in the MSN protocol handler of Gaim versions 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an unexpected sequence of MSNSLP messages, resulting in an unbounded copy operation that writes to the wrong buffer.
Vulnerability in Microsoft Proxy Server 2.0 and ISA Server 2000 allows a remote attacker to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results.
The vulnerability in Eset Anti-Virus before version 1.020 (September 16, 2004) allows a remote attacker to bypass antivirus protection via a compressed file with both local and global headers set to zero. Such a file can be opened on the target system without being detected by the antivirus software.
A vulnerability in RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
A vulnerability in the McAfee Anti-Virus Engine allows a remote attacker to bypass antivirus protection by sending a compressed file where both local and global headers are set to zero. Such a file is not blocked by the software and can be opened on the target system.
A vulnerability in Computer Associates (CA) antivirus products allows remote attackers to bypass antivirus protection by sending a compressed file with both local and global headers set to zero. Such a file is not detected as malicious but can be opened on the target system.