CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before version 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.
Buffer overflows in protegrity.dll of Protegrity Secure.Data Extension Feature (SEF) before version 2.2.3.9 allow attackers with SQL access to execute arbitrary code via extended stored procedures.
The hanterm (hanterm-xf) terminal emulator version 2.0.5 and earlier, and possibly later versions, allows attackers to modify the window title via a certain character escape sequence. This could lead to the insertion of a malicious sequence back into the command line in the user's terminal.
Clearswift MAILsweeper 4.x allows remote attackers to bypass attachment detection via an attachment that does not specify a MIME-Version header field, which is processed by some mail clients.
The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.
The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default 'admin' account with a blank password. This could allow attackers on the LAN side to conduct unauthorized activities.
Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.
parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.
Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.
Apple Darwin Streaming Administration Server version 4.1.2 and QuickTime Streaming Server version 4.1.1 allow remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method. This code is inserted into a log file and executed when the log is viewed using a browser.
Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename.
Buffer overflow in Sendmail versions 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments processed by the crackaddr function in headers.c.
A vulnerability in xdm allows arbitrary attackers to connect to the X server if the authComplain variable is set to false and the xdm auth directory does not exist.
The CVE-2002-1472 vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable pointing to a malicious module.
CVE-2002-0842 describes a format string vulnerability in certain modifications to mod_dav used for logging 502 Bad Gateway messages. Remote attackers can exploit this vulnerability to execute arbitrary code via a specially crafted URI.
The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.
Multiple buffer overflows in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 may allow attackers to cause a denial of service or execute arbitrary code, related to the usage of the vsprintf function.
Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username provided during login.
The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.
Multiple buffer overflows in Oracle 9i Database and earlier versions allow remote attackers to execute arbitrary code. The attack can be carried out through long arguments in the TO_TIMESTAMP_TZ, TZ_OFFSET, or BFILENAME functions.