CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arbitrary code via a long ShowPreferences argument.
A format string vulnerability in the SetBaseURL function in the AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.
Double free vulnerabilities in the error handling code for ASN.1 decoders in the KDC library and client library of MIT Kerberos 5 (krb5) version 1.3.4 and earlier may allow remote attackers to execute arbitrary code.
A buffer overflow in the ActiveX component (pdf.ocx) for Adobe Acrobat 5.0.5 and Acrobat Reader, and possibly other versions, allows remote attackers to execute arbitrary code via a URI for a PDF file with a null terminator (%00) followed by a long string.
Buffer overflow in the child_service function in the ident2 ident daemon allows remote attackers to execute arbitrary code.
Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
Clearswift MAILsweeper before 4.3.15 does not properly detect filenames in BinHex (HQX) encoded files, allowing remote attackers to bypass intended policy.
Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote attackers to execute arbitrary code by initiating an IKE negotiation and then sending an IKE packet with malformed ASN.1 data.
The vulnerability in Sygate Enforcer 3.5MR1 and earlier allows broadcast traffic to pass before authentication, which could allow remote attackers to bypass filtering rules.
A buffer overflow vulnerability in the Microsoft WordPerfect 5.x converter for Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.
Buffer overflow vulnerability in the MSN protocol plugins (object.c and slp.c) for Gaim before version 0.82. A remote attacker can cause a denial of service and potentially execute arbitrary code via improperly handled MSNSLP protocol messages in a strncpy call.
IBM DB2 versions 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries used in setuid root programs.
Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.
The vulnerability in KDE before version 3.3.0 involves improper handling of symbolic links pointing to stale locations. This could allow a local user to create or truncate arbitrary files on the system.
A critical heap-based buffer overflow vulnerability in the BMP image format parser of the QT library (qt3) before version 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
Buffer overflow in the JPEG parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
A vulnerability in mah-jong before version 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference.
Clearswift MAILsweeper before 4.3.15 does not properly detect and filter ZIP 6.0 encoded files, allowing remote attackers to bypass intended policy.
Buffer overflow in sqllib/security/db2ckpw for IBM DB2 Universal Database 6.0 and 7.0 allows local users to execute arbitrary code via a long username that is read from a file descriptor argument.