CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.
Webalizer 2.01-06 has a buffer overflow when configured to use reverse DNS lookups. This allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.
Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.
Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.
Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.
Buffer overflow in the file_comp function in rcp for IBM AIX 4.3.x and 5.1 allows remote attackers to execute arbitrary code.
Cross-site scripting vulnerability in analog before version 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is logged in web logfiles and not properly filtered by analog during display.
Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images, which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM.
Vulnerability in Imlib before version 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments passed to malloc, resulting in heap corruption.
Zope versions 2.2.0 through 2.5.1 do not properly verify access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
Icecast versions 1.3.11 and earlier are vulnerable to buffer overflows that allow remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.
AOL Instant Messenger (AIM) version 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions.
Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.
Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.
Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.
LogWatch 2.5 allows local users to gain root privileges via a symlink attack, which is a different vulnerability than CVE-2002-0162.
Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.
Check Point Firewall-1 versions 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules. This could allow local users to gain privileges or modify the firewall policy.
The vipw program in the util-linux package before version 2.10 causes the /etc/shadow file to be world-readable in some cases, making it easier for local users to perform brute force password guessing.
Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS