CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
An unknown vulnerability in the 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication through repeated login attempts using any username and password.
Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file.
A vulnerability in the Unreal Engine allows remote attackers to execute arbitrary code by sending a UDP packet with a long value in a secure query, causing memory overwrite. It affects multiple games including Unreal Tournament 2004, DeusEx, and Postal 2.
The eay_check_x509cert function in KAME Racoon incorrectly validates certificates even when OpenSSL validation fails, allowing remote attackers to bypass authentication.
The vulnerability in admin.php of Newsletter ZWS allows a remote attacker to gain administrative privileges by performing a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
Multiple format string vulnerabilities in the logquit, logerr, or loginfo functions in Software Upgrade Protocol (SUP) allow remote attackers to execute arbitrary code via format string specifiers in messages logged by syslog.
Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory. These are different vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool.
A stack-based buffer overflow in MySQL 4.1.x before 4.1.3 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string.
Buffer overflow in the msg function for rlpr daemon (rlprd) version 2.04 allows local users to execute arbitrary code.
SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.
PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifying the id parameter to reference a URL on a remote web server that contains the code.
CVE-2004-0393 describes a format string vulnerability in the msg function for the rlpr daemon (rlprd) version 2.0.4, allowing remote attackers to execute arbitrary code via format string specifiers in a buffer that cannot be resolved, which is passed to the syslog function.
The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, allowing local users to execute arbitrary commands via shell metacharacters in a system call.
Vulnerability in FreeS/WAN 1.x and 2.x and related products (superfreeswan 1.x, openswan before 1.0.6 and 2.1.4, strongSwan before 2.1.3) allows remote attackers to authenticate using spoofed PKCS#7 certificates. A self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
Vulnerability in osTicket allows remote attackers to view sensitive uploaded files and potentially execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
A vulnerability in Mailreader.com 2.3.30 and 2.3.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
CVE-2004-0448 describes a vulnerability in the log function for jftpgw version 0.13.4 and earlier, allowing remote authenticated users to execute arbitrary code via format string specifiers in certain syslog messages.
Buffer overflow in cgi.c in www-sql before version 0.5.7 allows local users to execute arbitrary code via a web page processed by www-sql.
Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.