CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
L-Forum versions 2.40 and earlier have a cross-site scripting (XSS) vulnerability when the 'Enable HTML in messages' option is enabled. This allows remote attackers to inject arbitrary scripts or HTML via message fields such as 'From', 'E-Mail', 'Subject', and 'Body'.
L-Forum 2.40 and earlier has a cross-site scripting vulnerability when the 'Enable HTML in messages' option is off. This allows remote attackers to insert arbitrary scripts or HTML via message fields including 'From', 'E-Mail', and 'Subject'.
Symantec Raptor Firewalls and other listed models generate easily predictable initial sequence numbers (ISN), allowing remote attackers to spoof connections.
Web Shop Manager version 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box.
CVE-2003-0188 vulnerability allows local users to execute arbitrary commands as other lv users by placing malicious .lv files in other directories.
Buffer overflows in EPIC IRC Client (EPIC4) version 1.0.1 allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long replies not properly handled by the userhost_cmd_returned function or Statusbar capability.
The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to admin/admin.shtml containing a leading // (double slash).
Buffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter.
Multiple buffer overflows in gPS before version 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges.
Leksbot version 1.2.3 on Debian GNU/Linux installs KATAXWR with setuid root, allowing local users to gain root privileges by exploiting unknown vulnerabilities related to the escalated privileges.
The GnuPG plugin in kopete before version 0.6.2 does not properly cleanse the command line when executing gpg, allowing remote attackers to execute arbitrary commands.
The 'ICQ Features on Demand' functionality for Mirabilis ICQ Pro 2003a does not properly verify the authenticity of software upgrades, allowing remote attackers to install arbitrary software via a spoofing attack.
Buffer overflow in Personal FTP Server allows remote attackers to execute arbitrary code via a long USER argument.
Multiple buffer overflows in SLWebMail 3 on Windows systems allow remote attackers to cause a denial of service and possibly execute arbitrary code via long Language and CompanyID parameters in various DLL files.
Multiple buffer overflows in Floosietek FTGate Pro Mail Server (FTGatePro) version 1.22 allow remote attackers to execute arbitrary code via long MAIL FROM or RCPT TO commands.
Happymall versions 4.3 and 4.4 allow remote attackers to execute arbitrary commands via shell metacharacters in the file parameter for the normal_html.cgi or member_html.cgi scripts.
Buffer overflow in youbin allows local users to gain privileges via a long HOME environment variable.
SLMail 5.1.0.4420 has multiple buffer overflows that can be exploited by remote attackers to execute arbitrary code. The attack can be carried out through long EHLO, XTRN, POPPASSWD arguments, or a long password to the POP3 server.
Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client versions 3.5.x through 4.0.REL, when enabling IPSec over TCP for a port, allow remote attackers to access the private network without authentication.