CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Carello E-Commerce version 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL.
The ActiveX control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML email message or web page.
Becky! version 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters.
The FTP server on Cisco Content Service 11000 series switches before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands.
Minicom version 1.83.1 and earlier allows a local attacker to gain additional privileges via numerous format string attacks.
The crontab in Vixie cron 3.0.1 and earlier does not properly drop privileges after a failed parsing of a modification operation, which could allow a local attacker to gain additional privileges when an editor is called to correct the error.
ScreamingMedia SITEWare versions 2.5 through 3.1 allow a remote attacker to read world-readable files via a .. (dot dot) attack through (1) the SITEWare Editor's Desktop or (2) the template parameter in SWEditServlet.
Buffer overflow in the BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
Oracle E-Business Suite Release 11i Applications Desktop Integrator (ADI) version 7.x includes a debug version of FNDPUB11I.DLL, which logs the APPS schema password in cleartext in a debug file. This allows local users to obtain the password and gain privileges.
Buffer overflow in dsh in dqs 3.2.7 in SuSE Linux 7.0 and earlier, and possibly other operating systems, allows local users to gain privileges via a long first command line argument.
eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, allowing a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS.
eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs.
CVE-2001-0522 describes a format string vulnerability in Gnu Privacy Guard (GnuPG or gpg) version 1.05 and earlier that can allow an attacker to gain privileges via format strings in the original filename stored in an encrypted file.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent filtering of SCRIPT tags by embedding scripts within certain HTML tags, such as onload in the BODY tag, href in the A tag, BUTTON tag, INPUT tag, or any other tag where scripts can be defined.
The web management service on Cisco Content Service series 11000 switches before WebNS 4.01B29s or WebNS 4.10B17s allows a remote attacker to gain additional privileges by directly requesting the web management URL instead of navigating through the interface.
The a1disp.cgi program in Drummond Miles A1Stats prior to version 1.6 allows a remote attacker to execute commands via a specially crafted URL containing shell metacharacters.
DCScripts DCForum versions 2000 and earlier allow a remote attacker to gain additional privileges by inserting pipe symbols (|) and newlines into the last name in the registration form, which will create an extra entry in the registration database.
OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.
Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, allowing a local attacker to execute arbitrary macros with the user ID of the Word user.