CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long 'RCPT TO,' 'SAML FROM,' or 'SOML FROM' commands.
Format string vulnerability in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.
Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.
Poll It 2.0 has a vulnerability in pollit.cgi that allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter.
A vulnerability in Element InstantShop allows remote attackers to modify price information via the 'price' hidden form variable in add_2_basket.asp.
CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication if the LDAP server allows null passwords.
AIX sysback before 4.2.1.13 uses a relative path to find and execute the hostname program, allowing local users to gain privileges by modifying the path to point to a malicious hostname program.
quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request.
Buffer overflow in EFTP allows remote attackers to cause a denial of service via a long string.
Buffer overflow in Darxite 0.4 and earlier allows a remote attacker to execute arbitrary commands via a long username or password.
Buffer overflow in XMail POP3 server before version 0.59 allows remote attackers to execute arbitrary commands via a long APOP command.
Buffer overflow in XMail POP3 server before version 0.59 allows remote attackers to execute arbitrary commands via a long USER command.
Buffer overflow in WinSMTP 1.06f and 2.X allows remote attackers to cause a denial of service via a long (1) USER or (2) HELO command.
Buffer overflow in the pam_smb and pam_ntdom pluggable authentication modules allows remote attackers to execute arbitrary commands via a login with a long user name.
The logging capability in muh 2.05d IRC server does not properly cleanse user-injected format strings. This allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed nickname.
The kernel logging daemon (klogd) in Linux does not properly cleanse user-injected format strings, allowing local users to gain root privileges by triggering malformed kernel messages.
A vulnerability in Microsoft Office 2000 allows an attacker to execute arbitrary commands by placing a malicious DLL in the same directory as the document. When the document is launched, the system looks for required DLLs in that directory, creating an opportunity for exploitation.
Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header.
Check Point VPN-1/FireWall-1 version 4.1 and earlier allows remote attackers to bypass the directionality check via fragmented TCP connection requests or reopening closed TCP connection requests.
The mailto CGI script allows remote attacker to execute arbitrary commands via shell metacharacters in the emailadd form field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS