CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Koules 1.4 allows local users to execute arbitrary commands via a long command line argument.
WinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group. This allows users to read and modify sensitive information such as passwords and gain access to the system.
Lotus Notes R5 client version 5.0.5 and earlier does not properly warn users when an S/MIME email message has been modified, which could allow an attacker to modify the email in transit without being detected.
The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, known as the 'Exchange User Account' vulnerability.
Buffer overflow in the setclock command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long argument.
Buffer overflow in the pioout command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands.
Buffer overflow in the phf CGI program allows remote attackers to execute arbitrary commands by specifying a large number of arguments and including a long MIME header.
Buffer overflow in AOL Instant Messenger before version 4.3.2229 allows remote attackers to execute arbitrary commands via a long 'goim' command.
The 24Link 1.06 web server allows remote attackers to bypass access restrictions by prepending strings such as '/+/' or '/.' to the HTTP GET request.
Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands.
The default configuration for the PostACI webmail system installs the /includes/global.inc configuration file within the web root, allowing remote attackers to read sensitive information such as database usernames and passwords via a direct HTTP GET request.
WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), allowing remote attackers to spoof or hijack TCP connections.
Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the 'From' field, allowing remote attackers to bypass virus protection.
The HTTP interface of Tivoli Lightweight Client Framework (LCF) in IBM Tivoli Management Framework 3.7.1 sets http_disable to zero at install time, allowing remote authenticated users to bypass file permissions on configuration data files.
Unspecified vulnerability in Haakon Nilsen's simple integrated publishing system (SIPS) before version 0.2.4, related to a 'grave security fault.'
CVE-2000-1233 describes an SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7, allowing remote attackers to execute arbitrary SQL queries via the sSQL parameter.
BEA Systems WebLogic Express and WebLogic Server versions 5.1 SP1-SP6 allow remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.
SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the query string of the URL.
The HTTP service in American Power Conversion (APC) PowerChute uses a default username and password, allowing remote attackers to gain system access.
Buffer overflow in the HP-UX cstm program allows local users to gain root privileges.