CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow vulnerability in the wvHandleDateTimePicture function of the wv library (wvWare) versions 0.7.4 through 0.7.6 and 1.0.0. An attacker can remotely execute arbitrary code by sending a document with a long DateTime field.
Buffer overflow vulnerability in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11. A remote attacker can send a request with a small fragment length and a large amount of data, leading to arbitrary code execution.
The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses C include files that define vsnprintf to use the less safe vsprintf function, which can lead to buffer overflow vulnerabilities that enable a denial of service (server crash) and possibly execute arbitrary code.
The vulnerability in the acpRunner ActiveX control version 1.2.5.0 allows a remote attacker to execute arbitrary code via the DownLoadURL, SaveFilePath, and Download methods. The attack can be carried out through a crafted web page.
A format string vulnerability in the SSL_set_verify function in telnetd.c of the SSLtelnet daemon (SSLtelnetd) version 0.13 allows remote attackers to execute arbitrary code.
Vulnerability in BEA WebLogic Server and WebLogic Express versions 7.0 through 7.0 Service Pack 4 and 8.1 through 8.1 Service Pack 2 allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
Off-by-one error in the POP3_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) via an e-mail message with a certain line length, which leads to a buffer overflow.
Vulnerability in PHP on Win32 platforms before version 4.3.7 allows attackers to execute arbitrary code, overwrite files, and access internal environment variables remotely or locally. The issue stems from improper filtering of shell metacharacters such as '%', '|', and '>' in the escapeshellcmd and escapeshellarg functions.
Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) 'c' compress option or (2) 'd' decompress option.
Heap-based buffer overflow in the HtmlHelp program (hh.exe) allows remote attackers to execute arbitrary commands via a .CHM file with a large length field.
An unknown vulnerability in Linux before version 2.4.26 for IA64 allows local users to cause a denial of service, with unknown impact.
Vulnerability in Lotus Domino 6.5.0 and 6.5.1 with IMAP enabled allows remote authenticated users to change their own quota using the IMAP setquota command.
Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.
A format string vulnerability in the printlog function in log2mail before version 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.
Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.
The vulnerability in eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.
Vulnerability in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.
Vulnerability in Mozilla Suite before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allows remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the putlvcb or getlvcb commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS