CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SSH Secure Shell for Servers versions 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.
Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code, related to a 'variable data type.'
Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, allowing remote attackers to gain administrative privileges via Telnet or HTTP.
Multiple buffer overflows in HP Tru64 UNIX 5.x allow local users to execute arbitrary code. These overflows can be triggered by long arguments in various commands and the DISPLAY environment variable.
Unspecified vulnerability in the pcilynx ieee1394 firewire driver in Linux kernel before 2.4.20, related to 'wrap handling'.
Finjan Software SurfinGate versions 6.0 and 6.0 1 allow remote attackers to bypass URL access restrictions by using an IP address instead of a hostname.
The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, allowing remote attackers to access the file system as root.
Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root.
ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.
Unspecified vulnerability in Internet Group Management Protocol (IGMP) of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors.
Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a long argument.
Sendmail versions 8.9.0 through 8.12.6 allow remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.
The default configuration in MySQL versions 3.20.32 through 3.23.52 on Windows does not have logging enabled, which could allow remote attackers to conduct activities without detection.
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, resulting in a read/write deadlock between httpd and the CGI script.
SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter.
CVE-2002-1885 is a remote file inclusion vulnerability in PowerPhlogger (PPhlogger) versions 2.0.9 through 2.2.2 in showhits.php3, allowing remote attackers to execute arbitrary PHP code via the rel_path parameter.
Terminal 1.3 in Apple Mac OS X 10.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a telnet:// link, which is executed by Terminal.app window.
Buffer overflow in AN HTTPd versions 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username.