CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Partition Manager (parmgr) in HP-UX B.11.23 does not properly validate certificates provided by the cimserver, allowing attackers to obtain sensitive data or gain privileges.
Symantec PCAnywhere versions 10.x and 11, when started as a service, allow attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe.
Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable.
Buffer overflow in iwconfig, when installed setuid, allows local users to execute arbitrary code via a long OUT environment variable.
Buffer overflow in the WAECHO default service in web-tools in SAP DB before version 7.4.03.30 allows remote attackers to execute arbitrary code via a URL with a long requestURI.
OpenCA versions before 0.9.1.4 incorrectly use certificates in the chain to check the serial number, which could lead to accepting revoked or expired certificates.
Versions of SAP database server (SAP DB) 7.4.03.27 and earlier allow local users to gain SYSTEM privileges via a malicious 'NETAPI32.DLL' in the current working directory, which is found and loaded by SAP DB before the real DLL.
The eo420_GetStringFromVarPart function in veo420.c for SAP database server (SAP DB) version 7.4.03.27 and earlier may have a vulnerability that allows remote attackers to execute arbitrary code. This issue arises from the failure to properly null-terminate a string, leading to a buffer overflow.
Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as adding new users to a console and adding spurious IDS rules to sensors.
A heap-based buffer overflow exists in rsync before version 2.5.7 when running in server mode. This allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
The web-tools in SAP DB before version 7.4.03.30 have a vulnerability that allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.
Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as swinstall and swmodify.
Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004 do not properly check the length of the 'Macro names' data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ('NetSetup.LOG').
CVE-2003-0946 describes a format string vulnerability in clamav-milter for Clam AntiVirus versions 0.60 through 0.60p and earlier than 0.65. This allows remote attackers to cause a denial of service and potentially execute arbitrary code via format string specifiers in the email address argument of a 'MAIL FROM' command.
The Web Database Manager in web-tools for SAP DB before version 7.4.03.30 generates predictable session IDs, allowing remote attackers to conduct unauthorized activities.
The ed editor for Sun Solaris 2.6, 7, and 8 allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
Unknown vulnerability in CDE Print Viewer (dtprintinfo) for Sun Solaris 2.6 through 9 may allow local users to execute arbitrary code.
Buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed GTP MSISDN string.
In Ethereal versions 0.9.15 and earlier, a heap-based buffer overflow allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SOCKS dissector.