CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Apache for Apple Mac OS X 10.2.8 and 10.3.6 stems from a case sensitivity mismatch between the server and the HFS+ filesystem. Apache restricts access to files only with exact case matching, while HFS+ treats them case-insensitively, allowing attackers to bypass restrictions.
Multiple buffer overflows in Oracle 9i before version 9.2.0.3 allow local users to execute arbitrary code. This can be achieved by setting the TIME_ZONE session parameter to a long value or providing long parameters to the NUMTOYMINTERVAL, NUMTODSINTERVAL, or FROM_TZ functions.
Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
The Postfix server in Apple Mac OS X 10.3.6, when using CRAM-MD5 authentication, allows remote attackers to send mail without authentication by replaying captured authentication information.
Buffer overflow vulnerability in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.
An unknown vulnerability in Cisco ONS 15327 before version 4.1(3), ONS 15454 before version 4.6(1), ONS 15454 SD before version 4.1(3), and Cisco ONS15600 before version 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
A stack-based buffer overflow in The Palace client version 3.5 and earlier allows remote attackers to execute arbitrary code via a link to a palace:// URL followed by a long server address string.
AIM Sniff (aimSniff.pl) version 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log.
IBM Cloudscape 5.1 running on jdk 1.4.2_03 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL code, possibly due to a SQL injection vulnerability.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
The firmware of the Gigabyte Gn-B46B 2.4Ghz wireless broadband router version 1.003.00 allows local users on the same network to bypass authentication by using a copy of the router's HTML menu on a separate system.
Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
The American Power Conversion (APC) Web/SNMP Management SmartSlot Card versions 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access.
A stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before version 4.5.538.001 and ZoneLabs Integrity client before version 4.0.146.046 and 4.5 before version 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 version 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.