CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.
Cayman 3220-H DSL Router 1.0 ships without a password set, allowing remote attackers to gain unauthorized access.
Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, allowing remote attackers to fully control clients via a Trojan horse Volution server.
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the 'Automatically put people I reply to in my address book' option enabled, do not notify the user when the 'Reply-To' address is different than the 'From' address. This could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.
Buffer overflow in qpopper (also known as qpop or popper) versions 4.0 through 4.0.2 allows remote attackers to gain privileges via a long username.
Buffer overflow in ja-elvis and ko-helvis ports of elvis allows local users to gain root privileges.
The locking feature in mIRC 5.7 allows local users to bypass the password mechanism by modifying the LockOptions registry key.
Buffer overflow in the www.tol module in America Online (AOL) 5.0 may allow remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL in a link.
Buffer overflow in Lotus Domino Mail Server 5.0.5 and earlier allows a remote attacker to crash the server or execute arbitrary code via a long 'RCPT TO' command.
The Fortran math component in Infobot 0.44.5.3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.
The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the 'Frame Domain Verification' vulnerability.
Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed recipient field.
Buffer overflow in Voyager web administration server for Nokia IP440 allows local users to cause a denial of service, and possibly execute arbitrary commands, via a long URL.
ProFTPD version 1.2.0rc2 has a format string vulnerability that may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory.
A format string vulnerability in VShell SSH gateway version 1.0.1 and earlier allows remote attackers to execute arbitrary commands via a user name that contains format string specifiers.
The cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting authentication information from a cookie.
Directory traversal vulnerability in HIS Auktion 1.62 allows remote attackers to read arbitrary files via a .. (dot dot) in the menue parameter. There is also a possibility to execute commands via shell metacharacters.
The pals-cgi program in the PALS Library System allows remote attackers to execute arbitrary commands via shell metacharacters in the documentName parameter.
FaSTream FTP++ Server 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long username.
Buffer overflow in Easycom/Safecom Print Server Web service, version 404.590 and earlier, allows remote attackers to execute arbitrary commands via (1) a long URL or (2) a long HTTP header field such as 'Host:'.