CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in Hypermail 2 before version 2.1.6 allow remote attackers to cause a denial of service and possibly execute arbitrary code. The attack can be performed via a long attachment filename or by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname.
Buffer overflow in the Windows Redirector function in Microsoft Windows XP allows local users to execute arbitrary code via a long parameter.
Buffer overflow in secure locate (slocate) before version 2.7 allows local users to execute arbitrary code via long command line arguments (-c or -r).
Unknown vulnerability in chk_trans.c of the libkrb5 library for MIT Kerberos V5 before version 1.2.5 allows users from one realm to impersonate users in other realms that have the same inter-realm keys.
The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code.
Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes.
Buffer overflow in escputil, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long printer-name command line argument.
Buffer overflow in the mtink status monitor, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long HOME environment variable.
Apache versions before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allow remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
Versions of noffle news server 1.0.1 and earlier are vulnerable to buffer overflows, allowing remote attackers to cause a denial of service (segmentation fault) and potentially execute arbitrary code.
A double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request.
Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.
Buffer overflow in AbsoluteTelnet before version 2.12 RC10 allows remote attackers to execute arbitrary code via a long window title.
The default .htaccess scripts for Bugzilla in versions 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file, which could allow remote attackers to obtain a database password by directly accessing the backup file.
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql.
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections.
Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3. The issue arises from invalid integer input processed as a different data type.
Buffer overflow in cnd-program for mgetty before 1.1.29 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long CallerName argument in the Caller ID string.
The dhcpcd DHCP client daemon version 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters fed from a dhcpd .info script into a .exe script.
Vulnerability in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a large negative argument, possibly triggering an integer signedness error or buffer overflow.