CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.
Funk Software Proxy Host versions 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control. This allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.
Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, allowing local users to gain privileges by recovering passwords from the PHOST.INI file or the Windows registry.
Zope versions 2.2.0 through 2.5.1 do not properly verify access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
Icecast versions 1.3.11 and earlier are vulnerable to buffer overflows that allow remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.
Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.
Lotus Domino Servers 5.x, 4.6x, and 4.5x allow attackers to bypass the intended Reader and Author access list for a document's object via a Notes API call (NSFDbReadObject) that directly accesses the object.
Cross-site scripting vulnerability in IIS 4.0, 5.0 and 5.1. A remote attacker can execute arbitrary script as other web users via the error message used in a URL redirect ("302 Object Moved") message.
Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.
Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
Webalizer 2.01-06 has a buffer overflow when configured to use reverse DNS lookups. This allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.
AOL Instant Messenger (AIM) version 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.
Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.
Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.
Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.
LogWatch 2.5 allows local users to gain root privileges via a symlink attack, which is a different vulnerability than CVE-2002-0162.
Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.
Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.