CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the priocntl system call in Solaris allows local users to execute arbitrary code via '..' sequences in the pc_clname field of a pcinfo_t structure, causing priocntl to load a malicious kernel module.
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
CVE-2002-1381 describes a format string vulnerability in daemon.c for Exim versions 4.x through 4.10 and 3.x through 3.36, allowing Exim administrative users to execute arbitrary code by modifying the pid_file_path value.
Fetchmail versions 6.1.3 and earlier have a heap-based buffer overflow that does not account for the '@' character when determining buffer lengths for local addresses. This allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
The overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.
Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the (1) LMP, (2) PPP, or (3) TDS dissectors, possibly related to a missing field for EndVerifyAck messages.
The COM_CHANGE_USER command in MySQL versions 3.x before 3.23.54 and 4.x before 4.0.6 allows remote attackers to gain privileges via a brute force attack using a one-character password, causing MySQL to only compare the provided password against the first character of the real password.
Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF).
The libmysqlclient client library in MySQL versions 3.x to 3.23.54 and 4.x to 4.0.6 does not properly verify length fields for certain responses in the read_rows and read_one_row routines. This may allow remote attackers to cause a denial of service and potentially execute arbitrary code.
The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, allowing remote attackers to cause an application crash.
Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.
Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via a long Transport field in a SETUP RTSP request, a DESCRIBE RTSP request with a long URL argument, or two simultaneous HTTP GET requests with long arguments.
Internet Explorer 5.5 and 6.0 does not perform complete security checks on external caching, allowing remote attackers to read arbitrary files.
An unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.
Buffer overflow in the irw_through function for Canna 3.5b2 and earlier allows local users to execute arbitrary code as the bin user.
Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model, enabling access to information on the local system or in other domains and possibly executing code via cached methods and objects.
Buffer overflow in the Dispatch() routine for the XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.
Alcatel OmniSwitch 7700/7800 switches running AOS 5.1.1 contain a back door telnet server intended for development that was not removed before distribution, allowing remote attackers to gain administrative privileges.
Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code. This is a new variant of the certificate validation flaw that could enable identity spoofing.
Multiple buffer overflows in RealOne and RealPlayer allow remote attackers to execute arbitrary code via a Synchronized Multimedia Integration Language (SMIL) file with a long parameter, a long filename in a rtsp:// request, or certain 'Now Playing' options on a downloaded file with a long filename.