CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ProFTPD version 1.2.9 incorrectly treats Allow and Deny directives for CIDR based ACL entries, which could allow FTP clients to bypass intended access restrictions.
Heap-based buffer overflow in the SendUidl function in the POP3 capability in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. A remote POP3 mail server could exploit this vulnerability to execute arbitrary code.
Integer overflow in the SOAPParameter object constructor in Netscape version 7.0 and 7.1 and Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.
Buffer overflow vulnerability in the uudecoding feature of Adobe Acrobat Reader for Unix and Linux allows remote attackers to execute arbitrary code by providing a PDF file with a long filename.
The uudecode feature in Adobe Acrobat Reader for Unix and Linux allows remote attackers to execute arbitrary code by using shell metacharacters (backtick) in the PDF filename.
CVE-2004-0425 describes a heap-based buffer overflow in SiteMinder Affiliate Agent 4.x that allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
Buffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
The libcpr in SGI IRIX before version 6.5.25 has a vulnerability that allows local users to gain privileges by loading a user-provided library while restarting the checkpointed process.
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4 allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
In Bugzilla versions 2.17.3 and 2.17.4, the describecomponents.cgi script does not properly verify group membership, allowing remote attackers to list component descriptions for otherwise restricted products.
In Bugzilla 2.16.3 and earlier, the editproducts.cgi script, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted. This allows users with those privileges to perform unauthorized additions to the next group assigned with the original group ID.
SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username or password parameters.
Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox, (2) comment, (3) Orientation, (4) PageOrder, or (5) Pages value.
A format string vulnerability in the QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the QUOTE command.
BlackICE PC Protection and Server Protection install configuration files (firewall.ini, blackice.ini, sigs.ini, protect.ini) with Everyone Full Control permissions. A local user can modify these files, e.g., by adding an oversized rule to firewall.ini, causing a denial of service (crash) or configuration change.
Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
A format string vulnerability in the printlog function in log2mail before version 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.
Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) 'c' compress option or (2) 'd' decompress option.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS