CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Aprelium Abyss Web Server before version 1.0.3 stores the administrative console password in plaintext in the abyss.conf file, allowing local users with access to the file to gain privileges.
Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.
Buffer overflow in sshd in OpenSSH versions 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication.
The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone.
A vulnerability in the RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.
In FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, local users can access restricted files by closing file descriptors 0, 1, or 2. This may lead to unauthorized reading or writing of data by setuid processes.
Oracle9i database server version 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.
Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet.
Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process.
The PL/SQL module in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, allowing remote attackers to gain privileges and modify DAD settings.
Buffer overflows in the PL/SQL module in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code. The attack can be carried out through various long HTTP requests and long passwords.
IBM Informix Web DataBlade 4.12 improperly processes user input, allowing remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
The webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.
Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into fields during new customer registration.
Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments in the /yell command, long lines in the /etc/melange.conf configuration file, long file names, or possibly other attacks.
Cross-site scripting vulnerability in Dynamic Guestbook 3.0 allows remote attackers to execute code in clients who access guestbook pages via the parameters (1) name, (2) mail, or (3) kommentar.
CVE-2002-0549 describes cross-site scripting vulnerabilities in Anthill that allow remote attackers to execute scripts as other Anthill users.
The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, allowing remote attackers with access to the admin.html file to gain administrative privileges to SWS.
The FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's 'FTP PORT' responses, allowing remote attackers to redirect FTP data connections to arbitrary ports, a variant of the 'FTP bounce' vulnerability.