CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The net.init rc script in HP-UX 11.00 allows local users to overwrite arbitrary files via a symlink attack that points from /tmp/stcp.conf to the targeted file.
Buffer overflow in SGI Omron WorldView Wnn allows remote attackers to execute arbitrary commands via long JS_OPEN, JS_MKDIR, or JS_FILE_INFO commands.
Buffer overflow in vqSoft vqServer 1.4.49 allows remote attackers to cause a denial of service or possibly gain privileges via a long HTTP GET request.
IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web browser.
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client.
BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
CVE-2000-0699 describes a format string vulnerability in ftpd on HP-UX 10.20 that allows remote attackers to cause a denial of service or execute arbitrary commands via format strings in the PASS command.
Buffer overflow in dmplay in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long command line option.
The xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack.
The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, allowing remote attackers to spoof the eTrust administrator and gain privileges.
The password protection feature of Microsoft Money can store the password in plaintext, allowing attackers with physical access to the system to obtain the password.
Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, allowing remote attackers to create a server on the victim's system via a malicious applet.
Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.
BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
The admin.php3 file in PHP-Nuke does not properly verify the administrator password, allowing remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameters.
The telnetd telnet server in IRIX versions 5.2 through 6.1 does not properly clean user-injected format strings, allowing remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.
Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option.
PCCS MySQLDatabase Admin Tool Manager version 1.2.4 and earlier installs the file dbconnect.inc within the web root, allowing remote attackers to obtain sensitive information such as the administrative password.
Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter.
Buffer overflow in gr_osview in IRIX 6.2 and 6.3 allows local users to gain privileges via a long -D option.