CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In wu-ftpd 2.6.2, there is an issue with not closing failed connections when running on operating systems that allow only one non-connected socket bound to the same local address. This can lead to denial of service.
BisonFTP Server 4 release 2 has a directory traversal vulnerability that allows remote attackers to list directories and files above the root directory.
WEB-ERP version 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password.
Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors.
RTS CryptoBuddy versions 1.0 and 1.2 use a weak encryption algorithm for the passphrase and generate predictable keys, making it easier for attackers to guess the passphrase.
A stack-based buffer overflow in eZnet.exe can be exploited by remote attackers to cause a denial of service (crash) or execute arbitrary code. The attack can be carried out via a long GET request or long operation or autologin parameters to SwEzModule.dll.
ProxyView has a default administrator password of 'Administrator' for Embedded Windows NT, which allows remote attackers to gain access.
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program.
Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.
CVE-2003-1170 describes a format string vulnerability in main.cpp in versions 0.9.1 and 0.9.5pre2 of kpopup. This allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.
Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the include_path parameter in several files.
Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke versions 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.
The scripts menu.inc.php, datasets.php, and mass_operations.inc.php in N/X 2002 allow remote attackers to execute arbitrary PHP code via a c_path that references a URL on a remote web server containing the code.
Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument.
In Mambo 4.0.12, the index2.php file allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.
Buffer overflow in Avant Browser 8.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.
A stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request.
Buffer overflow in the setupterm function of the lanadmin and landiag programs in HP-UX 10.0 through 10.34 allows local users to execute arbitrary code via a long TERM environment variable.
Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile, (2) a long path in diskusage, and (3) a long fname in flist.
Buffer overflow in CuteFTP versions 4.2 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.