CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use non-standard but frequently supported Content-Transfer-Encoding values such as uuencode, mac-binhex40, and yenc.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME encapsulation that uses RFC822 comment fields, which may be interpreted as other fields by mail clients.
Vulnerability in DB2 8.1 allows local users to escalate privileges via the remote command server (DB2RCMD.EXE), which executes the db2rcmdc.exe program as the db2admin administrator. Attackers can exploit the DB2REMOTECMD named pipe to gain control.
A buffer overflow vulnerability in WIDCOMM Bluetooth Connectivity Software, used in products such as BTStackServer 1.3.2.7 and 1.4.2.10, Windows XP and Windows 98 with MSI Bluetooth Dongles, and HP IPAQ 5450 running WinCE 3.0, allows remote attackers to execute arbitrary code via specially crafted service requests.
A format string vulnerability in the auth_debug function in Courier-IMAP versions 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.
The calendar program in bsdmainutils versions 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, allowing attackers to execute arbitrary commands via a calendar event file.
A stack-based buffer overflow in the xpm_extract_color function (io-xpm.c) of the XPM image decoder in gtk+ 2.4.4 and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a crafted color string.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use fields that use RFC2047 encoding, which may be interpreted differently by mail clients.
Unknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges.
SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the 'id' parameter in a view operation.
Vulnerability in SalesLogix 6.1 allows remote authenticated users to create arbitrary files and execute code by manipulating the vMME.AttachmentPath or vMME.LibraryPath variables, which are used to specify file write paths.
A buffer overflow vulnerability in MailCarrier 2.51 occurs when handling EHLO and possibly HELO commands. A remote attacker can exploit this to execute arbitrary code on the server.
A directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (dot dot) in the op parameter.
SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.
Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.
The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a direct HTTP request to app_sta.stm.
Vulnerability in attachment.html of Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request.
Vulnerability in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 allows remote attackers to delete or move arbitrary files on the server via the originalfolder and messageid parameters in viewaction.html.
Vulnerability in accountsettings_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions) allows remote attackers to create text files with arbitrary content via the accountid parameter.
Buffer overflow in digestmd5.c (CVS release 1.170) of the DIGEST-MD5 SASL plugin for Cyrus-SASL, not included in any official releases, allows remote attackers to execute arbitrary code.