CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The FTP server on Cisco Content Service 11000 series switches before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands.
eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs.
CVE-2001-0522 describes a format string vulnerability in Gnu Privacy Guard (GnuPG or gpg) version 1.05 and earlier that can allow an attacker to gain privileges via format strings in the original filename stored in an encrypted file.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document.
Becky! version 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent filtering of SCRIPT tags by embedding scripts within certain HTML tags, such as onload in the BODY tag, href in the A tag, BUTTON tag, INPUT tag, or any other tag where scripts can be defined.
Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags.
Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command.
book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the 'current' parameter.
Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.
Baltimore Technologies WEBsweeper versions 4.0 and 4.02 do not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering. Attackers can achieve this by adding an extra leading < before the SCRIPT tag or using tags in Unicode format.
Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided string, allowing remote attackers to bypass authentication with a 0 length community string.
Avaya Argent Office uses weak encryption (trivial encoding) for passwords, allowing remote attackers to gain administrator privileges by sniffing and decrypting passwords during system reboot.
NetWin SurgeFTP 2.0f and earlier uses weak password hashing with a fixed salt value and modulo 40 calculations, allowing remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.
A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264 does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.
The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The 'Network Name' or SSID, which is used as a shared secret to join the network, is transmitted in the clear.
The Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' (SSID) as the default WEP encryption key. This allows a remote attacker to determine the WEP key and decrypt RG-1000 traffic.
Sdbsearch.cgi in SuSE Linux versions 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file containing filenames with shell metacharacters. Attackers can exploit the HTTP_REFERER variable to point to the directory containing the keylist.txt file.
Zetetic Secure Tool for Recalling Important Passwords (STRIP) version 0.5 and earlier for PalmOS allows a local attacker to recover passwords via a brute force attack. This is made feasible by STRIP's use of SysRandom, seeded by TimeGetTicks, and an implementation flaw that significantly reduces the password search space.
Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript.