CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SSH Secure Shell for Servers and Workstations versions 2.0.13 through 3.2.1, when running without a PTY, does not call setsid, allowing attackers to gain certain privileges.
Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client versions 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via 'unsanitized input.'
Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.
SQL injection vulnerability in PHP-Nuke before version 6.0 allows remote authenticated users to modify the database and gain privileges via the 'bio' argument to modules.php.
An unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) versions 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges.
Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, allowing local users to modify /dev/mem and gain privileges via a modified PATH environment variable pointing to a Trojan horse gzip program.
The mailconf module in Linuxconf version 1.24 and earlier on Conectiva Linux 6.0 through 8 generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail as an open mail relay, allowing remote attackers to send spam.
The Mail::Mailer module in the perl-MailTools package version 1.47 and earlier uses mailx as the default mailer, allowing remote attackers to execute arbitrary commands by inserting them into the mail body.
QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to locate and execute the cp program with raised privileges, allowing local users to gain elevated privileges by modifying the PATH to point to a malicious cp program.
Buffer overflow in log2mail before version 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.
Buffer overflow in Abuse 2.00 and earlier allows local users to gain root privileges via a long -net command line argument.
Buffer overflow in Window Maker (wmaker) version 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a specially crafted image file that is not properly handled when allocating a buffer based on width and height information.
Abuse 2.00 and earlier allows local users to gain privileges via command line arguments that specify alternate Lisp scripts that run at escalated privileges.
CVE-2002-1244 describes a format string vulnerability in Pablo FTP Server versions 1.5, 1.3, and possibly others. It allows remote attackers to cause a denial of service and potentially execute arbitrary code via format strings in the USER command.
Peter Sandvik's Simple Web Server 0.5.1 and earlier allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE that points to code stored on a remote server, which is then used in (1) index.php, (2) install.php, or (3) various test_*.php scripts.
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, allowing attackers with only write permissions to upload malicious .COM files.
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors.
The kadm_ser_in function in the Kerberos v4 compatibility administration daemon (kadmind4) in MIT Kerberos 5 and in KTH Kerberos 4 and 5 improperly verifies the length field of a request, allowing remote attackers to execute arbitrary code via a buffer overflow attack.