CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.
The FTP service in Zaurus PDAs SL-5000D and SL-5500 does not require authentication, allowing remote attackers to access the file system as root.
Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.
CUPS versions 1.1.14 through 1.1.17 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by feeding negative arguments into memcpy() calls via HTTP requests with a negative Content-Length value or a negative length in chunked transfer encoding.
Multiple integer overflows in Common Unix Printing System (CUPS) versions 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via the CUPSd HTTP interface and the image handling code in CUPS filters.
Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.
Multiple buffer overflows in Winamp 3.0 when displaying an MP3 in the Media Library window allow remote attackers to execute arbitrary code via an MP3 file containing a long (1) Artist or (2) Album ID3v2 tag.
Buffer overflow in the Windows Shell function in Microsoft Windows XP allows remote attackers to execute arbitrary code via an .MP3 or .WMA audio file with a corrupt custom attribute.
CUPS versions 1.1.14 through 1.1.17 improperly use the strncat function when processing the options string, which can lead to a buffer overflow. This allows remote attackers to execute arbitrary code.
The Portable Network Graphics (PNG) library libpng 1.2.5 and earlier incorrectly calculates offsets, allowing remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
CUPS versions 1.1.14 through 1.1.17 allow remote attackers to add printers without authentication via a certain UDP packet. This can lead to unauthorized activities such as stealing the local root certificate for the administration server.
In Common Unix Printing System (CUPS) versions 1.1.14 through 1.1.17, there is a vulnerability that does not properly check for zero-length GIF images. This allows remote attackers to execute arbitrary code via modified chunk headers.
In Open WebMail version 1.81 and earlier, the openwebmail_init function allows local users to execute arbitrary code via .. (dot dot) sequences in a login name. Such a name is used in the sessionid parameter for the openwebmail-abook.pl script, leading to the discovery of a configuration file that specifies additional code to be executed.
CUPS versions 1.1.14 through 1.1.17 do not properly check the return values of various file and socket operations. This could allow a remote attacker to cause a denial of service by exhausting resources.
Fetchmail versions 6.1.3 and earlier have a heap-based buffer overflow that does not account for the '@' character when determining buffer lengths for local addresses. This allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
The overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.
Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF).
The COM_CHANGE_USER command in MySQL versions 3.x before 3.23.54 and 4.x before 4.0.6 allows remote attackers to gain privileges via a brute force attack using a one-character password, causing MySQL to only compare the provided password against the first character of the real password.
Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the (1) LMP, (2) PPP, or (3) TDS dissectors, possibly related to a missing field for EndVerifyAck messages.
CVE-2002-1381 describes a format string vulnerability in daemon.c for Exim versions 4.x through 4.10 and 3.x through 3.36, allowing Exim administrative users to execute arbitrary code by modifying the pid_file_path value.