CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.
Tinyproxy versions 1.5.0, 1.4.3, and earlier allow remote attackers to execute arbitrary code via memory that is freed twice (double-free).
Cross-site scripting vulnerabilities in the iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute scripts as the administrator via modified LOCID or OC parameters in administrator URLs.
Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.
Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2 may be vulnerable to a SQL injection attack, allowing remote attackers to cause a denial of service or execute certain queries via manipulation of the sort order parameter in buglist.cgi.
Opera browser versions 6.01, 6.0, and 5.12 allow remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.
Buffer overflow in the X11 library (libX11) on Caldera Open UNIX 8.0.0 and UnixWare 7.1.1, and possibly other operating systems, allows local users to gain root privileges via a long -xrm argument to programs such as dtterm or xterm.
In Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2, during a mass change, the groupset of all bugs is set to the groupset of the first bug. This could inadvertently lead to insecure groupset permissions being assigned to some bugs.
Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.
imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as ftp, owwwPath, and oftpPath.
Off-by-one overflow in the PreservePermissions function in rcs.c for CVS before version 1.11.2 allows local users to execute arbitrary code.
Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long 'bind DN' parameter.
getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter. This issue is addressed by the 'UpdateUser' hot fix.
A vulnerability in artsd, invoked by artswrapper, allows local users to gain privileges via format strings in the -a argument, leading to improper handling of an error message in the arts_fatal function.
ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the 'pseudo' cookie.
SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for image files or other files.
SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands.
The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length.
Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.