CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
DotBr 0.1 stores config.inc with insufficient access control under the web document root, allowing remote attackers to obtain sensitive information such as SQL usernames and passwords.
Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.
Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) versions 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via a client with a long hostname.
Buffer overflow in wall for HP-UX versions 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
Aprelium Technologies Abyss Web Server version 1.1.2, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty Connection or Range fields.
Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) versions 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.
Incorrect file handling in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 may allow attackers to gain access or cause a denial of service.
Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before version 4.2.15.0 allow remote attackers to execute arbitrary code via long commands such as EXAMINE, DELETE, SUBSCRIBE, RENAME, UNSUBSCRIBE, LIST, LSUB, STATUS, LOGIN, CREATE, or SELECT.
The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals.
Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command.
WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions.
CuteNews 0.88 has a PHP remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the cutepath parameter in shownews.php, search.php, or comments.php.
The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, allowing remote attackers to obtain sensitive information via a direct request to database/db2000.mdb.
MaxWebPortal version 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 'news', 'lock', or 'allmem' fields in the 'start new topic' HTML page.
CVE-2003-1178 describes an eval injection vulnerability in comments.php in Advanced Poll 2.0.2 that allows remote attackers to execute arbitrary PHP code via the (1) id, (2) template_set, or (3) action parameter.
MAILsweeper for SMTP version 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited by certain MIMAIL virus variants.
The SIP implementation in Ingate Firewall and Ingate SIParator before version 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages.
Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) version 1.2 allows remote attackers to execute arbitrary code via unknown vectors.
Unknown vulnerability in the Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to a memory allocation problem, has unknown impact.
Buffer overflow in rcp for AIX 4.3.3, 5.1 and 5.2 allows local users to gain privileges.