CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the RFC822 address parser in mutt before version 1.2.5.1 and in 1.3.x before 1.3.25 allows remote attackers to execute arbitrary commands via an improperly terminated comment or phrase in the address list.
Heap corruption vulnerability in the 'at' program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the same memory twice.
Many SNMP implementations have vulnerabilities that can be exploited by remote attackers to cause denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite.
The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to bypass access control, potentially leading to license theft.
Multiple SNMPv1 implementations have vulnerabilities in request handling that can be exploited by remote attackers to cause denial of service or gain privileges via GetRequest, GetNextRequest, and SetRequest messages.
The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges through various parameters in scripts.
CVE-2001-0891 describes a format string vulnerability in the NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX. This allows a local user to gain root privileges by submitting a batch job with a name that contains formatting characters.
In Bugzilla versions before 2.14.1, the CGI.pl script allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, resulting in a null password being sent to the LDAP server.
Bugzilla before version 2.14.1 allows remote attackers to spoof user comments and post bugs as another user by manipulating parameters in HTTP requests.
A format string vulnerability exists in stunnel before version 3.22 when used in client mode for smtp, pop, or nntp, allowing remote malicious servers to execute arbitrary code.
OpenLDAP versions from 2.0 to 2.0.19 allow local and anonymous users (before 2.0.8) to perform a 'replace' action on access controls without values, leading to the deletion of non-mandatory attributes that should be protected by ACLs.
Versions of sudo from 1.6.0 to 1.6.3p7 do not properly clear environment variables before calling the mail program, which could allow local users to gain root privileges by modifying these variables.
Buffer overflow in AOL Instant Messenger (AIM) versions 4.7.2480, 4.8.2616, and others allows remote attackers to execute arbitrary code via a long argument in a game request (AddGame).
Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.
The vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to invoke executables present on the local system through HTML objects with the codebase property. This is known as the 'Local Executable Invocation via Object tag' vulnerability.
Buffer overflow in passwd for HP UX B.10.20 allows local users to execute arbitrary commands with root privileges via a long LANG environment variable.
Buffer overflow in grpck and pwck, if installed setuid on a system, may allow local users to gain privileges via a long command line argument.
Java Runtime Environment (JRE) and SDK versions 1.2 through 1.3.0_04 allow untrusted applets to access the system clipboard.
A format string vulnerability in libvanessa_logger version 0.0.1 in Perdition 0.1.8 allows remote attackers to execute arbitrary code via format string specifiers in the __vanessa_logger_log function.