CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenBSD versions 2.9 through 3.1 allow local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.
In OpenSSH 3.2.2, when using YP with netgroups, there is a possibility that users may successfully authenticate and log in with another user's password under certain conditions.
Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to plugin.php, admin.php, or del.php that modifies the PHORUM[settings_dir] variable to point to a directory containing a PHP file with the commands.
Vulnerability in the administration server for HP VirtualVault 4.5 on HP-UX 11.04 allows remote web servers or privileged external processes to bypass access restrictions and establish connections to the server.
Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root.
Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.
Buffer overflow in lsmcode in AIX 4.3.3 may lead to unauthorized access or execution of malicious code.
Vulnerability in template.dhcpo in AIX 4.3.3 related to an insecure linker argument.
Buffer overflow in pioout on AIX 4.3.3 may lead to unauthorized access or execution of malicious code.
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients.
CVE-2002-0735 describes a format string vulnerability in the logging() function in the C-Note Squid LDAP authentication module (squid_auth_LDAP) version 2.0.2 and earlier. This allows remote attackers to trigger log messages, potentially leading to denial of service and arbitrary code execution.
The b2edit.showposts.php file in B2 version 2.0.6pre2 and earlier has a flaw that fails to properly load the b2config.php file in some configurations. This allows remote attackers to execute arbitrary PHP code via a URL that sets the $b2inc variable to point to a malicious program stored on a remote server.
Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent page, which causes thttpd to insert the script into a 404 error message.
Cross-site scripting vulnerability in MyGuestbook 1.0 allows remote attackers to execute arbitrary script or inject HTML via fields such as (1) user name or (2) comments.
Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function.
A heap-based buffer overflow in the TFTP server capability in Cisco IOS versions 11.1, 11.2, and 11.3 can be exploited by remote attackers. Attackers can cause a denial of service or modify configuration by sending a long filename.
The 'Same Origin Policy' (SOP) in Netscape, Mozilla, and Internet Explorer allows a remote web server to access HTTP and SOAP/XML content from restricted sites. An attacker can exploit this vulnerability by mapping the malicious server's DNS domain to the restricted site and passing information between frames.
The wwwoffled program in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.
FreeBSD kernel 4.6 and earlier closes file descriptors 0, 1, and 2 after they have been assigned to /dev/null when the descriptors reference procfs or linprocfs. This could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.