CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.
Internet Explorer versions 5, 5.6, and 6 allow remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData (storeuserData) feature.
Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via the SOCKS, RSVP, AFS, or LMP dissectors, which can be caused to core dump.
FreeBSD kernel 4.6 and earlier closes file descriptors 0, 1, and 2 after they have been assigned to /dev/null when the descriptors reference procfs or linprocfs. This could allow local users to reuse the file descriptors in a setuid or setgid program to modify critical data and gain privileges.
The wwwoffled program in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.
The 'Same Origin Policy' (SOP) in Netscape, Mozilla, and Internet Explorer allows a remote web server to access HTTP and SOAP/XML content from restricted sites. An attacker can exploit this vulnerability by mapping the malicious server's DNS domain to the restricted site and passing information between frames.
Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.
KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems do not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
A cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.
CVE-2002-0412 describes a vulnerability in the TraceEvent function in ntop before version 2.1 that allows remote attackers to execute arbitrary code by injecting format strings into calls to the syslog function. This can be done via an HTTP GET request, a username in HTTP authentication, or a password in HTTP authentication.
Check Point FireWall-1 SecuRemote/SecuClient versions 4.0 and 4.1 allow clients to bypass the 'authentication timeout' by modifying the to_expire or expire values in the client's users.C configuration file.
The file filemanager_forms.php in PHProjekt versions 3.1 and 3.1a has a vulnerability that allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter.
Foundry Networks ServerIron switches do not decode URIs when applying 'url-map' rules, which could make it easier for attackers to forward traffic to a different server than intended.
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434.
CVE-2002-0458 is a cross-site scripting vulnerability in News-TNK version 1.2.1 and earlier that allows remote attackers to execute arbitrary Javascript via the WEB parameter.
Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.
Standalone Macromedia Flash Player 5.0 before version 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the 'exec' FSCommand.
ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d allows user 'skank' on machine 'starscream' to become a key manager when the 'first time connection' feature is enabled and before any legitimate administrators have connected.
Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.
The traceroute.pl CGI script version 1.0 for Linux Directory Penguin allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.