CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unknown vulnerability in the CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user and possibly execute PHP code by bypassing the CGI force redirect settings.
Apple File Protocol (AFP) in Mac OS X before 10.2.4 allows administrators to log in as other users by using the administrator password.
The CVE-2002-1472 vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable pointing to a malicious module.
Multiple buffer overflows in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 may allow attackers to cause a denial of service or execute arbitrary code, related to the usage of the vsprintf function.
The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.
Multiple buffer overflows in Oracle 9i Database and earlier versions allow remote attackers to execute arbitrary code. The attack can be carried out through long arguments in the TO_TIMESTAMP_TZ, TZ_OFFSET, or BFILENAME functions.
Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username provided during login.
The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.
The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.
CVE-2002-0842 describes a format string vulnerability in certain modifications to mod_dav used for logging 502 Bad Gateway messages. Remote attackers can exploit this vulnerability to execute arbitrary code via a specially crafted URI.
A vulnerability in xdm allows arbitrary attackers to connect to the X server if the authComplain variable is set to false and the xdm auth directory does not exist.
The FTP client for Solaris 2.6, 7, and 8 with the debug (-d) flag enabled displays the user password on the screen during login.
Buffer overflow in Eset Software NOD32 for UNIX before version 1.013 allows local users to execute arbitrary code via a long path name.
The PostgreSQL auth module for courier version 0.40 and earlier has an SQL injection vulnerability that allows remote attackers to execute SQL code via the user name.
The Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.
CVE-2003-0074 describes a format string vulnerability in mpmain.c for plpnfsd of the plptools package that allows remote attackers to execute arbitrary code via the functions debuglog, errorlog, and infolog.
CVE-2003-0060 describes format string vulnerabilities in the logging routines for MIT Kerberos V5 KDC before version 1.2.5. This allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via format string specifiers in Kerberos principal names.
The uml_net tool in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, allowing local users to modify network interfaces, such as changing ARP entries or placing interfaces into promiscuous mode.
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, created with the original user's credentials after root uses su.
Buffer overflow in secure locate (slocate) before version 2.7 allows local users to execute arbitrary code via long command line arguments (-c or -r).