CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the control service for MERCUR Mailserver 4.2 allows remote attackers to execute arbitrary code via a long password.
The config_inc2.php file in Mantis before version 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via specified parameters and cookies.
Buffer overflow in the inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.
The default Access Control Lists (ACLs) of the administration database for ZMerge 4.x and 5.x provide arbitrary users (including anonymous users) with Manager level access, allowing them to read or modify import/export scripts.
Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allow remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to execute arbitrary code via long command line arguments to the programs such as amcheck, amgetidx, amtrmidx, createindex-dump, or createindex-gnutar.
Jana Server version 1.4.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large message index value in RETR or DELE commands to the POP3 server, which exceeds array limits and allows a buffer overflow attack.
Multiple buffer overflows in Thomas Hauck's Jana Server versions 2.x through 2.2.1 and 1.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code.
SquirrelMail versions 1.2.7 and earlier have cross-site scripting vulnerabilities that allow remote attackers to execute scripts as other web users. Attacks can be conducted via addressbook.php, options.php, search.php, or help.php.
Buffer overflow in Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Subject field.
CVE-2002-1027 describes a vulnerability in the default HTTP 500 error script (500error.jsp) for Macromedia Sitespring 1.2.0, allowing remote attackers to execute arbitrary web scripts. Attackers can achieve this by linking to 500error.jsp with the script in the et parameter.
Cisco IOS versions 12.0 through 12.2, when supporting SSH, is vulnerable to an attack that can lead to denial of service through CPU consumption. An attacker can send a large packet designed to exploit the SSH CRC32 attack detection overflow.
Buffer overflow in Van Dyke SecureCRT SSH client before version 3.4.6 and 4.x before 4.0 beta 3 allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.
Buffer overflow in RealJukebox 2 and RealOne Player Gold allows remote attackers to execute arbitrary code via an RFS skin file whose skin.ini contains a long value in a CONTROLnImage argument.
Buffer overflow in web server for Tivoli Management Framework (TMF) ManagedNode versions 3.6.x through 3.7.1 allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.
Cross-site scripting vulnerability in the urlcount.cgi script, included in the Lil' HTTP web server, allows remote attackers to execute arbitrary web scripts in other web browsers. The issue arises because requests to urlcount.cgi containing the script are not filtered when the REPORT capability prints the original request.
CVE-2002-1009 describes a cross-site scripting vulnerability in the pbcgi.cgi script, part of the Lil' HTTP web server. This allows remote attackers to execute arbitrary web scripts in other users' browsers via the 'Name' or 'E-mail' parameters.
AnalogX Proxy versions before 4.12 are vulnerable to buffer overflows that allow remote attackers to cause a denial of service and potentially execute arbitrary code. The attack can be performed via a long HTTP request to TCP port 6588 or a long DNS hostname in a SOCKS 4A request to TCP port 1080.
Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long request to TCP port 8001.
SunPCi II VNC uses a weak authentication scheme, allowing remote attackers to obtain the VNC password by sniffing the random byte challenge used as the key for encrypted communications.