CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In SquirrelMail version 1.0.4 and earlier, the load_prefs.php file and supporting files do not properly initialize certain PHP variables. This allows remote attackers to view sensitive files and execute arbitrary code by uploading a message that could be interpreted as PHP.
Buffer overflow in logging functions of licq before version 1.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary commands.
Buffer overflow in dtsession on Solaris, and possibly other operating systems, allows local users to gain privileges via a long LANG environmental variable.
Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL.
Transsoft Broker version 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request with a specific type.
Microsoft Data Access Component Internet Publishing Provider version 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests.
Licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
ArGoSoft FTP Server version 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a '.lnk.' extension, which bypasses WFTPD's check for a '.lnk' extension.
PHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to the mail() function, allowing local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter.
Multiple buffer overflows in the s.cgi program in Aspseek search engine version 1.03 and earlier allow remote attackers to execute arbitrary commands via (1) a long HTTP query string, or (2) a long tmpl parameter.
A directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the '.ASX Buffer Overrun' vulnerability.
CVE-2001-0489 describes a format string vulnerability in gftp prior to version 2.0.8 that allows malicious remote FTP servers to execute arbitrary commands.
Buffer overflow in the Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request passed to the extension through IIS 5.0.
Buffer overflow in lpsched on DGUX version R4.20MU06 and MU02 allows a local attacker to obtain root access via a long command line argument (non-existent printer name).
Vulnerability in rpmdrake in Mandrake Linux 8.0 related to insecure temporary file handling.
Buffer overflow in WINAMP 2.6x and 2.7x allows attackers to execute arbitrary code via a long string in an AIP file.