CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple stack-based buffer overflows in the encode_mime, encode_uuencode, and decode_uuencode functions for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames.
A stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004 allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) allow remote attackers to execute arbitrary code via a SRV_MULTI response containing long fields, as exploited by the Witty worm.
Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, causing Opera to send the cookie outside the specified URL subsets.
Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets.
PHP remote file inclusion vulnerability in affich.php of Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base parameter.
An unknown vulnerability in xitalk 1.1.11 and earlier allows local users to execute arbitrary commands.
The LiveUpdate capability in Symantec AntiVirus Scan Engine versions 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink attack on /tmp/LiveUpdate.log.
Buffer overflow in the getaddrinfo function in Python 2.2 before 2.2.2, when IPv6 support is disabled, allows remote attackers to execute arbitrary code via an IPv6 address that is obtained using DNS.
Multiple buffer overflows in the AGate component for SAP Internet Transaction Server (ITS) allow remote attackers to execute arbitrary code via long parameters ~command, ~runtimemode, ~session, or a long HTTP Content-Type header.
CVE-2004-0121 in Microsoft Outlook 2002 has an argument injection vulnerability that insufficiently filters parameters of mailto: URLs. This allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.
CVE-2003-0257 describes a format string vulnerability in the printer capability for IBM AIX versions 3, 5.1, and 5.2, allowing local users to gain printq or root privileges.
Vulnerability in ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass email protection via attachments whose names contain certain non-English characters.
SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.
SQL injection vulnerability in auth.php and admin.php files of PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account by sending base64-encoded SQL in the admin parameter.
The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL.
Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode and offset parameters in many PHP scripts.
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the Theme, Country, Real Name, or Displayed time zone fields in a User Profile, or the Name, Description, URL, or Country fields in a Directory/Add Site operation.
The X-Micro WLAN 11b Broadband Router version 1.6.0.1 contains hardcoded credentials: username and password "1502". This allows remote attackers to gain access to the device.
X-Micro WLAN 11b Broadband Router versions 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 contain a hardcoded administrative account named "super" with a default password. This allows a remote attacker to gain full access to the device without authorization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS