CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in routed for HP Tru64 UNIX from V4.0F to V5.1A allows local and remote attackers to read arbitrary files.
Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier allow remote attackers to execute arbitrary code via certain packets sent to UDP port 694.
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, MSDE 1.0, and MSDE 2000 can be executed by PUBLIC, allowing an attacker to gain privileges by updating a webtask owned by the database owner.
In Bugzilla 2.14.x before 2.14.4 and 2.16.x before 2.16.1, the editproducts.cgi script, when the 'usebuggroups' feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, granting extra permissions to users.
Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long 'From' address, triggering the overflow when the user views or previews the message.
Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbound message.
PAM 0.76 treats a disabled password as if it were an empty (null) password, allowing local and remote attackers to gain privileges as disabled users.
Balabit Syslog-NG versions 1.4.x before 1.4.15 and 1.5.x before 1.5.20 improperly track the size of a buffer during macro expansion, which may lead to denial of service and potentially allow remote attackers to execute arbitrary code.
Avaya Cajun switches P880, P882, P580, and P550R version 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, allowing remote attackers to gain privileges.
A vulnerability in the WebBrowser control used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via a script that accesses the Document property, bypassing <frame> and <iframe> domain restrictions.
The bugzilla_email_append.pl script in Bugzilla versions 2.14.x before 2.14.4 and 2.16.x before 2.16.1 has a vulnerability that allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.
Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
Multiple buffer overflows in Heimdal before version 0.5, possibly in both (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.
Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, allowing remote attackers to execute arbitrary SQL via a SQL injection attack.
JFS (JFS3.1 and OnlineJFS) in HP-UX 10.20, 11.00, and 11.04 does not properly implement the sticky bit functionality, which could allow attackers to bypass intended restrictions on filesystems.
Konqueror in versions 3.0 through 3.0.2 does not properly detect the 'secure' flag in HTTP cookies, which may lead to cookies being sent over an unencrypted channel.
The cross-site scripting protection for Konqueror in KDE versions 2.2.2 and 3.0 through 3.0.3 does not properly initialize domains on sub-frames and sub-iframes. This can allow remote attackers to execute scripts and steal cookies from subframes that are in other domains.
Buffer overflow in the Database Console Command (DBCC) in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a 'non-SQL OLEDB data source' such as FoxPro.
Buffer overflow in MySQL daemon (mysqld) before version 3.23.50 and 4.0 beta before 4.02 on the Win32 platform allows local users to execute arbitrary code via a long 'datadir' parameter in the my.ini initialization file.
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16 does not authenticate requests to reset the device, allowing remote attackers to cause a denial of service via a direct request to the device_reset CGI program.