CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft SQL Server 7, 2000, and MSDE allow local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port, leading to a buffer overflow.
A stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.
Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response.
The EXTPROC functionality in Oracle9i Database and Oracle 8i has a stack-based buffer overflow that can be exploited by authenticated database users to execute arbitrary code via a long library name.
Multiple buffer overflows in Novell iChain 2.1 before Field Patch 3 and iChain 2.2 before Field Patch 1a allow attackers to cause a denial of service (ABEND) and possibly execute arbitrary code via (1) a long user name or (2) an unknown attack related to a "special script against login."
BEA WebLogic Server and Express, when using NodeManager to start servers, allow Operator users to overwrite usernames and passwords, which may enable Operators to gain Admin privileges.
Multiple buffer overflows in ActiveX controls used by Trend Micro HouseCall 5.5 and 5.7, and Damage Cleanup Server 1.0 allow remote attackers to execute arbitrary code via long parameter strings.
Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.
Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail.
Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with large length for a Text or Copyright string, or a large number of tracks, leading to a heap-based buffer overflow.
Buffer overflow in the HTTP server for Cisco IOS 12.2 and earlier allows remote attackers to execute arbitrary code via an extremely long (2GB) HTTP GET request.
Buffer overflow in Internet Explorer 6 SP1 for certain languages that support double-byte encodings (e.g., Japanese) allows remote attackers to execute arbitrary code via the Type property of an Object tag.
Buffer overflow in the mylo_log logging function for mod_mylo 0.2.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
An unknown vulnerability in the display of Merge before version 5.3.23a in UnixWare 7.1.x allows local users to gain root privileges.
VMware GSX Server 2.5.1 and earlier, and Workstation 4.0 and earlier, allow local users to gain root privileges via certain environment variables used when launching a virtual machine session.
Apple QuickTime / Darwin Streaming Server before 4.1.3f is vulnerable to an attack that can lead to service crashes. An attacker can exploit an MS-DOS device name (e.g., AUX) in a request sent to HTTP port 1220.
Internet Explorer versions 5.01 SP3 through 6.0 SP1 allow remote attackers to access and execute scripts in the My Computer zone using the browser cache via crafted Content-Type and Content-Disposition headers.
Buffer overflow in the Oracle Applications Web Report Review (FNDWRR) CGI program may allow remote attackers to execute arbitrary code via a long URL. This affects Oracle E-Business Suite versions from 11.0 to 11.5.8.
The installation of Apple QuickTime / Darwin Streaming Server before version 4.1.3f starts the administration server with a 'Setup Assistant' page that allows remote attackers to set the administrator password and gain privileges before the real administrator.
Up2date versions 3.0.7 and 3.1.23 do not properly verify RPM GPG signatures, which could allow remote attackers to install unsigned packages from the Red Hat Network if that network is compromised.