CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.
An unknown vulnerability in the Graphics Rendering Engine of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via Windows Metafile (WMF) or Enhanced Metafile (EMF) image formats that involve 'an unchecked buffer.'
The vulnerability in Sophos Small Business Suite 1.00 on Windows involves improper handling of files whose names contain reserved MS-DOS device names such as LPT1, COM1, AUX, CON, or PRN. This allows malicious code to bypass detection when installed, copied, or executed.
The RPC Runtime Library for Microsoft Windows NT 4.0 contains a vulnerability that allows a remote attacker to read active memory or cause a system crash via a malicious message, possibly related to improper length values.
Integer overflow vulnerability in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition. A remote attacker can exploit improper length validation in compressed (zipped) folders to execute arbitrary code.
Buffer overflow vulnerability in Windows Program Group Converter (grpconv.exe) allows remote attackers to execute arbitrary code via a specially crafted shell: URL with a long filename and .grp extension, which is not properly handled when the shell launches grpconv.exe.
The NNTP component in Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 contains a vulnerability that allows remote code execution via specially crafted XPAT patterns. The issue is due to improper length validation and heap-based buffer overflows (off-by-one and heap-based buffer overflow).
Buffer overflow vulnerability in the mysql_real_connect function in MySQL 4.x before 4.0.21 and 3.x before 3.23.49. Remote DNS servers can cause a denial of service and potentially execute arbitrary code via a DNS response with a large address length (h_length).
RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1.
Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated.
Vulnerability in MySQL before versions 3.23.59, 4.0.19, 4.1.2, and 5.0.1 incorrectly checks CREATE/INSERT privileges on the original table instead of the target table during an ALTER TABLE RENAME operation. This could allow attackers to perform unauthorized actions on tables.
Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, leading to a heap-based buffer overflow.
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the 'SSLCipherSuite' directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
The vulnerability in the SMTP component of Windows XP 64-bit, Windows Server 2003, and the Exchange Routing Engine component of Exchange Server 2003 allows a remote attacker to execute arbitrary code by sending a malicious DNS response with improperly validated length values.
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
Multiple buffer overflows in Sun Java System Web Proxy Server (formerly Sun ONE Proxy Server) versions 3.6 through 3.6 SP4 allow remote attackers to execute arbitrary code via unknown vectors, possibly CONNECT requests.
A heap-based buffer overflow in the WvTFTPServer::new_connection function in wvtftpserver.cc for WvTftp 0.9 allows remote attackers to execute arbitrary code via a long option string in a TFTP packet.
The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254, which displays a management interface and information on established connections.
A format string vulnerability in log.c in rssh before version 2.2.2 allows remote authenticated users to execute arbitrary code.
Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.