CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The default permissions for the MTS Package Administration registry key in Windows NT 4.0 allow local users to install or modify arbitrary Microsoft Transaction Server (MTS) packages, potentially leading to privilege escalation.
MailMan Webmail version 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate_template parameter.
In FreeBSD and possibly other operating systems, procfs does not properly restrict access to per-process mem and ctl files. This allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's address space.
Check Point VPN-1/FireWall-1 version 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets.
Buffer overflow in the HTTP server on the WatchGuard SOHO firewall allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long GET request.
The HTTP server on the WatchGuard SOHO firewall does not properly restrict access to administrative functions such as password resets or rebooting, allowing attackers to cause a denial of service or conduct unauthorized activities.
The vulnerability in register.cgi in Ikonboard 2.1.7b and earlier allows remote attackers to execute arbitrary commands via the SEND_MAIL parameter, which overwrites an internal program variable that references a program to be executed.
The simplestguest.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the guestbook parameter.
The everythingform.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.
A backdoor account in the Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures.
The ad.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
Buffer overflow in oops WWW proxy server version 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or domain name obtained from a reverse DNS lookup.
CVE-2001-0060 describes a format string vulnerability in stunnel 3.8 and earlier that allows attackers to execute arbitrary commands via a malformed ident username.
A one-byte buffer overflow in the replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.
Buffer overflow in the kdc_reply_cipher function of the libkrb library (Kerberos 4 authentication library) in NetBSD 1.5 and FreeBSD 4.2 and earlier, used in Kerberized applications such as telnetd and login, allows local users to gain root privileges.
CVE-2001-0013 describes a format string vulnerability in the nslookupComplain function in BIND 4 that allows remote attackers to gain root privileges.
The simplestmail.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the MyEmail parameter.
The Winsock2ProtocolCatalogMutex in Windows NT 4.0 has inappropriate permissions, allowing local users to modify them to 'No Access', leading to disruption of Winsock network connectivity.
The GTK+ library allows local users to specify arbitrary modules via the GTK_MODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program.
Buffer overflow in Kermit communications software in HP-UX 11.0 and earlier allows local users to cause a denial of service and possibly execute arbitrary commands.