CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in admin.php of Newsletter ZWS allows a remote attacker to gain administrative privileges by performing a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
The vulnerability in the gzexe tool in gzip version 1.3.3 and earlier causes the execution of an argument when the creation of a temporary file fails, instead of exiting the program. This could allow remote attackers or local users to execute arbitrary commands.
Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a negative add_dsa_buf_bytes variable, which leads to a buffer overflow.
The check_scramble_323 function in MySQL 4.1.x before 4.1.3 and MySQL 5.0 allows remote attackers to bypass authentication by sending a zero-length scrambled string.
A format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
A vulnerability in Mailreader.com 2.3.30 and 2.3.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
Buffer overflow in cgi.c in www-sql before version 0.5.7 allows local users to execute arbitrary code via a web page processed by www-sql.
PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifying the id parameter to reference a URL on a remote web server that contains the code.
Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file.
Vulnerability in osTicket allows remote attackers to view sensitive uploaded files and potentially execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
Vulnerability in FreeS/WAN 1.x and 2.x and related products (superfreeswan 1.x, openswan before 1.0.6 and 2.1.4, strongSwan before 2.1.3) allows remote attackers to authenticate using spoofed PKCS#7 certificates. A self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
An unknown vulnerability in the 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication through repeated login attempts using any username and password.
SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.
Multiple buffer overflows in Oracle 9i before version 9.2.0.3 allow local users to execute arbitrary code. This can be achieved by setting the TIME_ZONE session parameter to a long value or providing long parameters to the NUMTOYMINTERVAL, NUMTODSINTERVAL, or FROM_TZ functions.
The vulnerability in Apache for Apple Mac OS X 10.2.8 and 10.3.6 stems from a case sensitivity mismatch between the server and the HFS+ filesystem. Apache restricts access to files only with exact case matching, while HFS+ treats them case-insensitively, allowing attackers to bypass restrictions.
Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
The Postfix server in Apple Mac OS X 10.3.6, when using CRAM-MD5 authentication, allows remote attackers to send mail without authentication by replaying captured authentication information.
Buffer overflow vulnerability in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.
An unknown vulnerability in Cisco ONS 15327 before version 4.1(3), ONS 15454 before version 4.6(1), ONS 15454 SD before version 4.1(3), and Cisco ONS15600 before version 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
CVE-2004-0277 in Dream FTP 1.02 has a format string vulnerability that allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via format string specifiers in the username.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS