CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the HttpGetRequest function in Zeroo HTTP server 1.5 allows remote attackers to execute arbitrary code via a long HTTP request.
Calisto Internet Talker 0.04 and earlier allows remote attackers to cause a denial of service (hang) via a long request, possibly triggering a buffer overflow.
Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.
Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP POST request.
Linksys WET11 firmware versions 1.31 and 1.32 allow remote attackers to cause a denial of service (crash) by sending a packet with the device's hardware address as the source MAC address in the DLC header.
Multiple buffer overflows in NEC SOCKS5 1.0 r11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long username.
MySimpleNews has a static code injection vulnerability that allows remote attackers to inject arbitrary PHP code and HTML via the LOGIN, DATA, and MESS parameters.
A format string vulnerability in the newsx NNTP client before version 1.4.8 allows local users to execute arbitrary code via improperly handled format string specifiers in a call to the syslog function.
Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing one additional character after .html, .htm, .asp, or .inc, such as .aspx files.
Buffer overflow in lscfg of unknown versions of AIX may lead to unknown impact on the system.
Cisco IOS software versions 11.3 through 12.2 on Cisco uBR7200 and uBR7100 series routers allows remote attackers to modify DOCSIS settings via a DOCSIS file without a Message Integrity Check (MIC) signature, which is approved by the router.
The c-client library in IMAP before version 2002 RC2, used by Pine versions 4.20 to 4.44, allows remote attackers to cause a client crash via a MIME-encoded email with a Content-Type header containing an empty boundary field.
SWAIS version 1.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the search field, as demonstrated using the '|' (pipe) character.
A vulnerability in Cisco AS5350 IOS 12.2(11)T allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an SSH bug. The issue occurs with access control lists (ACLs) applied.
Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed source IP address of 127.0.0.1 or network address of 127.0.0.0.
csGuestbook.cgi in CGISCRIPT.NET csGuestbook 1.0 allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.
Sun AnswerBook2 versions 1.2 through 1.4.2 allow remote attackers to execute administrative scripts such as AdminViewError and AdminAddadmin via a direct request.
An unknown vulnerability in the login program on AIX before version 4.0 could allow remote users to specify 100 or more environment variables when logging on, exceeding the length of a certain string, potentially triggering a buffer overflow.
phpShare versions before 0.6 beta 3 allow remote attackers to include and execute arbitrary PHP scripts from remote servers.
acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2.