CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The dupatch and setld utilities in HP Tru64 UNIX 5.1B PK1 and earlier allow local users to overwrite files and possibly gain root privileges via a symlink attack.
The mod_auth_any package in Red Hat Enterprise Linux 2.1 and other operating systems does not properly escape arguments when calling other programs, allowing attackers to execute arbitrary commands via shell metacharacters.
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to rawdocdata.asp or RawCustomSearchField.asp containing an embedded SQL statement.
Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 improperly check parameters passed during third-party rendering, which could allow remote attackers to execute arbitrary web scripts.
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in Content-type and Content-encoding fields.
Buffer overflow in PostMethod() function for Monkey HTTP Daemon (monkeyd) 0.6.1 and earlier allows remote attackers to execute arbitrary code via a POST request with a large body.
Buffer overflow in the administration service (CSAdmin) for Cisco Secure ACS before version 3.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long user parameter to port 2002.
Kerio Personal Firewall (KPF) version 2.1.4 and earlier allows remote attackers to execute administrator commands by sniffing packets from a valid session and replaying them against the remote administration server.
KDE 2 and KDE 3.1.1 and earlier 3.x versions allow attackers to execute arbitrary commands via PostScript (PS) or PDF files, due to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer.
Multiple buffer overflows in Samba before version 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service.
In MacOS X, DirectoryServices trusts the PATH environment variable to locate and execute the touch command, allowing local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.
The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet.
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, leading to a heap-based buffer overflow.
The xfsdump program in version xfsdq does not securely create quota information files, allowing local users to gain root privileges.
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
Cacti before version 0.6.8 allows attackers to execute arbitrary commands via the 'Data Input' option in console mode.
SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.
CVE-2002-1482 describes an SQL injection vulnerability in login.php for phpGB version 1.20 and earlier, when magic_quotes_gpc is not enabled. This allows remote attackers to gain administrative privileges by injecting SQL code into the password field.
Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.
In Cacti before version 0.6.8, the graphs.php file allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.