CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in the Speedtouch USB driver before version 1.3.1 allows local users to execute arbitrary code via modem_run, pppoa2, or pppoa3.
A vulnerability in Apple iChat AV 2.1, AV 2.0, and 1.0.1 allows remote attackers to execute arbitrary programs via a specially crafted link.
Vulnerability in Sendmail before version 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a configuration script with a fixed username and password, allowing remote attackers to use Sendmail as an open mail relay to send spam.
Multiple buffer overflows in MMDF on OpenServer 5.0.6 and 5.0.7, and possibly other operating systems, may allow attackers to execute arbitrary code, as demonstrated via the execmail program.
A stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier may occur in situations that cross security boundaries, such as an FTP server. This may allow remote attackers to execute arbitrary code via a long filename argument.
Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from 'memory corruption') via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the '<STYLE>@;/*' string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the 'CSS Heap Memory Corruption Vulnerability.'
Format string vulnerability in telnetd-ssl version 0.17 and earlier allows remote attackers to execute arbitrary code.
Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the attrib_valid function, covert function, declare statement, crafted query plan, or crafted install java statement (requires database owner or 'sa' role privileges).
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.
Buffer overflow in htget 0.93 allows remote attackers to execute arbitrary code via a crafted URL.
Untrusted execution path vulnerability in the diag commands (lsmcode, diag_exec, invscout, invscoutd) in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.
Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.
The Asante FM2008 device running firmware version 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access.
The vulnerability in Cisco Unity versions 2.x, 3.x, and 4.x integrated with Microsoft Exchange is due to hard-coded usernames and passwords. A remote attacker can exploit these credentials to gain unauthorized access and change configuration settings or read incoming and outgoing email messages.
The vulnerability in Asante FM2008 running firmware 1.06 stores the username and password in cleartext in the configuration backup, which could allow remote attackers to gain unauthorized access.
Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
CVE-2004-0448 describes a vulnerability in the log function for jftpgw version 0.13.4 and earlier, allowing remote authenticated users to execute arbitrary code via format string specifiers in certain syslog messages.
Vulnerability in osTicket allows remote attackers to view sensitive uploaded files and potentially execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
A vulnerability in Mailreader.com 2.3.30 and 2.3.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.