CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adiscon WinSyslog 4.21 SP1 is vulnerable to a denial of service attack that can be triggered by remote attackers sending long syslog messages.
Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.
Unspecified vulnerability in CDE dtmailpr of HP Tru64 versions 4.0F through 5.1B allows local users to gain privileges via unknown attack vectors.
Kerio Personal Firewall (KPF) version 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), allowing remote attackers to bypass the firewall filters.
The slashem-tty program in the FreeBSD Ports Collection is installed with write permissions for the games group, allowing local users with games group privileges to modify slashem-tty and execute arbitrary code as other users.
Aladdin Knowlege Systems eSafe Gateway version 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, allowing remote attackers to bypass virus protection.
CuteNews 0.88 has a PHP remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the cutepath parameter in shownews.php, search.php, or comments.php.
Buffer overflow in wall for HP-UX versions 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
MAILsweeper for SMTP version 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited by certain MIMAIL virus variants.
Aprelium Technologies Abyss Web Server version 1.1.2, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty Connection or Range fields.
The SIP implementation in Ingate Firewall and Ingate SIParator before version 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages.
Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) version 1.2 allows remote attackers to execute arbitrary code via unknown vectors.
Unknown vulnerability in the Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to a memory allocation problem, has unknown impact.
An unknown vulnerability in sendmail for Solaris 7, 8, and 9 allows local users to cause a denial of service and possibly gain privileges via certain constructs in a .forward file.
Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) versions 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.
Incorrect file handling in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 may allow attackers to gain access or cause a denial of service.
Buffer overflow in rcp for AIX 4.3.3, 5.1 and 5.2 allows local users to gain privileges.
Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before version 4.2.15.0 allow remote attackers to execute arbitrary code via long commands such as EXAMINE, DELETE, SUBSCRIBE, RENAME, UNSUBSCRIBE, LIST, LSUB, STATUS, LOGIN, CREATE, or SELECT.
The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals.
WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS