CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.
The calendar.pl and calendar_admin.pl scripts by Matt Kruse allow remote attackers to execute arbitrary commands via shell metacharacters.
Buffer overflow in the krb425_conv_principal function in Kerberos 5 allows remote attackers to gain root privileges.
The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, allowing the user to gain privileges by specifying an alternate program to execute.
Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges.
CGI counter version 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.
The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, allowing an attacker to download any type of file to a user's system by encoding it within an email message or news post.
The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, allowing them to modify user accounts or web pages.
The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers.
Buffer overflow in the Solaris netpr program allows local users to execute arbitrary commands via a long -p option.
The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker to recover it and use it to decrypt EFS data.
The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.
The Office 2000 UA ActiveX Control is marked as 'safe for scripting,' allowing remote attackers to conduct unauthorized activities via the 'Show Me' function in Office Help.
The vulnerability in ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by sending a request to the file with a large number of encoded spaces (%20) and ending with a .htr extension.
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the device's MAC address. This could allow remote attackers to gain root access.
Buffer overflow in the Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.
Buffer overflow in the SMTP gateway for InterScan Virus Wall 3.32 and earlier allows a remote attacker to execute arbitrary commands via a long filename for a uuencoded attachment.
Buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8 allows remote attackers to execute arbitrary commands.
The pam_console module in Linux systems performs a chown on various devices upon user login. An open file descriptor for those devices can remain active after the user logs out, allowing that user to sniff activity on these devices when subsequent users log in.
The resolver in glibc 2.1.3 uses predictable IDs, allowing a local attacker to spoof DNS query results.