CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in Ability Server versions 2.25, 2.32, 2.34, and possibly others, allows remote attackers to execute arbitrary code via a long APPE command.
Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, allowing local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).
SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages with malformed quoting in MIME headers, parameters, and values.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME encapsulation that uses RFC822 comment fields, which may be interpreted as other fields by mail clients.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use RFC2231 encoding, which may be interpreted differently by mail clients.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use whitespace in an unusual fashion, which may be interpreted differently by mail clients.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use multiple MIME fields with the same name, which may be interpreted differently by mail clients.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use fields that use RFC2047 encoding, which may be interpreted differently by mail clients.
Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.
Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector.
Multiple stack-based buffer overflows were found in libXpm before version 6.8.1 in functions xpmParseColors, ParseAndPutPixels, and ParsePixels. A remote attacker can exploit a specially crafted XPM image file to execute arbitrary code.
Multiple integer overflows in libXpm before version 6.8.1 in functions xpmParseColors, XpmCreateImageFromXpmImage, CreateXImage, ParsePixels, and ParseAndPutPixels may allow remote attackers to execute arbitrary code via a malformed XPM image file.
A vulnerability in libpng version 1.2.5 and earlier results from improper calculation of buffer offsets. A remote attacker can exploit this flaw to cause a buffer overflow and execute arbitrary code.
The calendar program in bsdmainutils versions 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, allowing attackers to execute arbitrary commands via a calendar event file.
Vulnerability in DB2 8.1 allows local users to escalate privileges via the remote command server (DB2RCMD.EXE), which executes the db2rcmdc.exe program as the db2admin administrator. Attackers can exploit the DB2REMOTECMD named pipe to gain control.
A buffer overflow vulnerability in WIDCOMM Bluetooth Connectivity Software, used in products such as BTStackServer 1.3.2.7 and 1.4.2.10, Windows XP and Windows 98 with MSI Bluetooth Dongles, and HP IPAQ 5450 running WinCE 3.0, allows remote attackers to execute arbitrary code via specially crafted service requests.
An integer overflow in Gaim before version 0.82 in the size variable of Groupware server messages allows remote attackers to cause a denial of service and possibly execute arbitrary code.
In redhat-config-nfs before version 1.0.13, an unknown vulnerability when shares are exported to multiple hosts can cause incorrect permissions and prevent the all_squash option from being applied.