CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
A class that supports XML in Microsoft Virtual Machine 5.0.3805 and earlier exposes unsafe methods, allowing remote attackers to execute unsafe code via a Java applet.
Buffer overflows in the ApacheBench benchmark support program (ab.c) before version 1.3.27 and Apache 2.x before version 2.0.43 can be exploited by a malicious web server. This may lead to denial of service and potentially allow arbitrary code execution via a long response.
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16 does not authenticate requests to reset the device, allowing remote attackers to cause a denial of service via a direct request to the device_reset CGI program.
The cross-site scripting protection for Konqueror in KDE versions 2.2.2 and 3.0 through 3.0.3 does not properly initialize domains on sub-frames and sub-iframes. This can allow remote attackers to execute scripts and steal cookies from subframes that are in other domains.
Buffer overflow in MySQL daemon (mysqld) before version 3.23.50 and 4.0 beta before 4.02 on the Win32 platform allows local users to execute arbitrary code via a long 'datadir' parameter in the my.ini initialization file.
Buffer overflow in the Database Console Command (DBCC) in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a 'non-SQL OLEDB data source' such as FoxPro.
The HTML Help facility in Microsoft Windows 98, 98 SE, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder. This allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file.
Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 SE, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via a long parameter to the Alink function or script containing a long argument to the showHelp function.
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames.
CVE-2002-0709 describes SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter that allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs.
UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, allowing remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function.
The Web Reports Server for SurfControl SuperScout WebFilter stores the 'scwebusers' username and password file in a web-accessible directory, allowing remote attackers to obtain valid usernames and crack passwords.
Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code via a certain type of web file request.
Multiple format string vulnerabilities in in.rarpd (ARP server) on Solaris, Caldera UnixWare and Open UNIX, and possibly other operating systems, allow remote attackers to execute arbitrary code via format strings that are not properly handled in the functions syserr and error.
Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a '?' character, which is treated as a wildcard character.
Buffer overflow in traffic_manager for Inktomi Traffic Server versions 4.0.18 through 5.2.2, Traffic Edge versions 1.1.2 and 1.5.0, and Media-IXT version 3.0.4 allows local users to gain root privileges via a long path argument.
login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to 'insert,' which adds the provided username to the adminUsers table.
Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Multiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.