CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.
Buffer overflow in Transsoft Broker FTP Server 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of . (dot) characters.
The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, allowing attackers to connect to the server from the same IP address as a user who has already established a session.
Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, making it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.
Buffer overflow in the management web interface of Red-M 1050 (Bluetooth Access Point) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.
The TFTP server for Red-M 1050 (Bluetooth Access Point) cannot be disabled, making it easier for remote attackers to crack the administration password via brute force methods.
The Network Address Translation (NAT) capability for Netfilter ('iptables') 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.
The FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, allowing remote attackers to bypass firewall rules or spoof FTP server responses.
CVE-2002-0716 describes a format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 that allows local users to gain privileges via format string specifiers in the file name argument.
Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.
The sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
Buffer overflow in the bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.
Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication.
The registry key containing the SQL Server service account information in Microsoft SQL Server 2000 has insecure permissions, allowing local users to gain privileges.
Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the NS-rel-doc-name parameter.
A heap-based buffer overflow in the message decoding functionality for the PGP Outlook Encryption Plug-In allows remote attackers to modify the heap and gain privileges via a large, malformed mail message.
Cross-site scripting vulnerability in GoAhead Web Server 2.1 allows remote attackers to execute script as other web users via script in a URL that generates a '404 not found' message, which does not quote the script.
The web interface for the Pingtel xpressa SIP-based VoIP phone versions 1.2.5 to 1.2.7.4 allows authenticated users to modify Call Forwarding settings, potentially leading to call hijacking.
The CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, potentially gaining privileges. This issue occurs in the AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.