CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
DeleGate versions 7.7.0 and 7.7.1 have a cross-site scripting vulnerability. The issue is that scripting commands are not properly quoted in the '403 Forbidden' error page, allowing remote attackers to execute arbitrary Javascript on other clients.
CVE-2001-1203 describes a format string vulnerability in gpm-root in gpm versions 1.17.8 through 1.17.18 that allows local users to gain root privileges.
Namazu versions 2.0.9 and earlier have a cross-site scripting vulnerability that allows remote attackers to execute arbitrary Javascript as other web users. The issue occurs in the error message returned when an invalid index file is specified in the idxname parameter.
The web administration server for ELSA Lancom 1100 Office does not require authentication, allowing remote attackers to gain administrative privileges by connecting to the server.
Namazu versions 2.0.8 and earlier have a cross-site scripting vulnerability that allows remote attackers to execute arbitrary Javascript in the context of other web users via the index file name displayed when showing hit numbers.
The get_input function in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL injection attack.
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, allowing local users to gain root privileges.
The Cyrus SASL library has a format string vulnerability in the default logging callback function _sasl_syslog, which may allow remote attackers to execute arbitrary commands.
D-Link DWL-1000AP Firmware 3.2.28 #483 stores the administrative password in plaintext in the default Management Information Base (MIB), allowing remote attackers to gain administrative privileges.
Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
The uuxqt program in the Taylor UUCP package improperly removes dangerous long options, allowing local users to gain privileges by calling uux and specifying an alternate configuration file with the --config option.
Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the system.
Directory traversal vulnerability in the HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request. This affects versions 2.0 through 2.6.18 and 2.6.19 through 3.0.10.
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.
Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions raiserror, formatmessage, or xp_sprintf.
PFinger versions 0.7.5 through 0.7.7 have a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in a .plan file.
Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters.
Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file.
Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys.