CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack.
phpShare versions before 0.6 beta 3 allow remote attackers to include and execute arbitrary PHP scripts from remote servers.
Cisco IOS versions 11.2.x and 12.0.x does not limit the size of its redirect table, allowing remote attackers to cause a denial of service (memory consumption) via spoofed ICMP redirect packets sent to the router.
VelociRaptor 1.0 has a memory leak in the httpd, nntpd, and VPN driver components, allowing remote attackers to cause a denial of service through memory consumption.
Netgear FM114P firmware version 1.3 allows remote attackers to cause a denial of service (crash or hang) by sending a large number of TCP connection requests.
VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges.
f2html.pl versions 0.1 through 0.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via file names.
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
The SURECOM EP-4501 broadband router uses a default SNMP read community string of 'public' and a default SNMP read/write community string of 'secret,' allowing remote attackers to read and modify router configuration information.
Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.
acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2.
Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.
An unknown vulnerability in WesMo phpEventCalendar 1.1 allows remote attackers to execute arbitrary commands via unknown attack vectors.
Buffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC versions 2.5 through 2.7 may allow remote attackers to have unknown impact with unknown attack vectors.
Netgear RP114 Cable/DSL router with firmware 3.26 uses a default administrator password and accepts admin logins on the external interface, allowing remote attackers to gain privileges if the password is not changed.
UTStarcom BAS 1000 version 3.1.10 creates several default or backdoor accounts and passwords, allowing remote attackers to gain access to the system.
Multiple buffer overflows in realtime operating system (RTOS) 6.1.0 allow local users to execute arbitrary code via (1) a long ABLANG environment variable in phlocale or (2) a long -u option to pkg-installer.
CVE-2002-2022 describes a format string vulnerability in Kaffe OpenVM 1.0.6 and earlier that allows local users to execute arbitrary code when a java.lang.NoClassDefFoundError is thrown, via format specifiers in the forName attribute.
Buffer overflow in CHttpServer::OnParseError in the ISAPI extension when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0 and 6.0 before SP3 can lead to denial of service and potentially execute arbitrary code by remote attackers.
The x_news.php file in X-News (x_news) version 1.1 and earlier allows remote attackers to gain administrative privileges by stealing and replaying the md5_password cookie.