CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the ptrace mechanism in SCO UnixWare 7.1.3 and 7.1.4 allows local users to gain privileges via unknown attack vectors.
A vulnerability in login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid.
A heap-based buffer overflow in Apple QuickTime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted QuickTime Image File (QTIF), PICT, or JPEG format image with a long data field.
The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
TYPO3 version 3.8.0 and earlier allows remote attackers to obtain sensitive information by directly requesting the misc/phpcheck/ directory, which invokes the phpinfo function and prints values of unspecified environment variables.
BugPort 1.147 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the devWherePair[0], orderBy, and where parameters.
An unspecified vulnerability in the multi-language environment library (libmle) in Solaris 7 and 8, shipped with the Japanese locale, allows local users to gain privileges via unknown attack vectors.
Geeklog before version 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
A vulnerability in BEA WebLogic Server and WebLogic Express versions 9.0, 8.1, and 7.0 locks out the admin account after multiple incorrect password guesses. A remote attacker who knows or guesses the admin account name can cause a denial of service (DoS) by blocking admin logins.
In IBM DB2 8.1 with Satellite Administration (SATADMIN) enabled, the SATENCRYPT function has a stack-based buffer overflow. A remote attacker can execute arbitrary code via a long parameter.
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, do not use the secure t3s protocol even when an Administration port is enabled on the Administration server. This could allow remote attackers to sniff the connection.
A heap-based buffer overflow in Novell Open Enterprise Server Remote Manager (novell-nrm) for Novell SUSE Linux Enterprise Server 9 allows remote attackers to execute arbitrary code via an HTTP POST request with a negative Content-Length parameter.
The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings.
Unspecified vulnerability in Spey 0.3.3 related to multiple security holes that could lead to compromise. This issue is distinct from CVE-2005-4846.
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, allowing remote attackers to read JSP source files and obtain sensitive information.
A CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.
In IBM DB2 8.1, shared memory sections and events have default read and write permissions for the Everyone group, allowing local users to gain unauthorized access, obtain sensitive information such as cleartext passwords, and cause a denial of service.
A stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.
A stack-based buffer overflow in db2fmp in IBM DB2 versions 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS