CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model, enabling access to information on the local system or in other domains and possibly executing code via cached methods and objects.
Alcatel OmniSwitch 7700/7800 switches running AOS 5.1.1 contain a back door telnet server intended for development that was not removed before distribution, allowing remote attackers to gain administrative privileges.
A heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary code via an HTTP GET request with a long .cfm file name.
The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript. This allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities.
The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class and bypass intended restrictions.
An unknown vulnerability in the telnet KIO subsystem (telnet.protocol) of KDE 2.x 2.1 and later allows local and remote attackers to execute arbitrary code via a certain URL.
Multiple buffer overflows in LISa on KDE 2.x for 2.1 and later, and KDE 3.x before 3.0.4 allow local and possibly remote attackers to execute arbitrary code via the 'lisa' daemon. Remote attackers can also execute arbitrary code via a certain 'lan://' URL.
Multiple buffer overflows in conf.c for Masqmail versions 0.1.x before 0.1.17 and 0.2.x before 0.2.15 allow local users to gain privileges via certain entries in the configuration file (-C option).
The Microsoft Java implementation, used in Internet Explorer, allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code via the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices class. The methods of this class do not verify the memory addresses passed as parameters.
A heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) versions 2.1 through 2.6 and Internet Explorer 5.01 through 6.0 allows remote attackers to execute code via a malformed HTTP request to the Data Stub.
Buffer overflow in LISa allows local users to gain access to a raw socket via a long LOGNAME environment variable for the resLISa daemon.
Buffer overflows in the DNS stub resolver library in ISC BIND from versions 4.9.2 to 4.9.10 and other derived libraries such as BSD libc and GNU glibc allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the getnetbyname or getnetbyaddr functions.
Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.
CVE-2002-1308 involves a heap-based buffer overflow in Netscape and Mozilla browsers that allows remote attackers to execute arbitrary code. This issue occurs when a malicious .jar file is decompressed via a jar: URL.
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion.
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions.
Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records.
In the LPRng package, the runlpr tool allows the local lp user to gain root privileges via certain command line arguments.
The Microsoft Java implementation, used in Internet Explorer, provides a public load0() method for the CabCracker class, allowing remote attackers to bypass the security checks performed by the load() method.
A heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary code via an HTTP GET request with a long .jsp file name.