CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
nph-maillist.pl allows remote attackers to execute arbitrary commands via shell metacharacters ("`") in the email address.
Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable.
Licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL.
Buffer overflow in ipcs in Solaris 7 x86 allows local users to execute arbitrary code via a long TZ (timezone) environmental variable.
Microsoft Data Access Component Internet Publishing Provider version 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests.
Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request with a specific type.
Buffer overflow in QPC QVT/Net Popd 4.20 in QVT/Net 5.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands via (1) a long username, or (2) a long password.
dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using the AZ parameter to reference the program.
Buffer overflows in various CGI programs in the remote administration service for Trend Micro Interscan VirusWall 3.01 allow remote attackers to execute arbitrary commands.
ArGoSoft FTP Server version 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a '.lnk.' extension, which bypasses WFTPD's check for a '.lnk' extension.
PHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to the mail() function, allowing local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Buffer overflows in Sierra Half-Life versions up to 1573 allow remote attackers to execute arbitrary code. The attack can be carried out via a long map command, a long exec command, or long input in a configuration file.
Eudora before 5.1 allows a remote attacker to execute arbitrary code when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags.
A directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
Multiple buffer overflows in the s.cgi program in Aspseek search engine version 1.03 and earlier allow remote attackers to execute arbitrary commands via (1) a long HTTP query string, or (2) a long tmpl parameter.
Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary commands.
A directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by the Bugzilla_login cookie in post_bug.cgi or the who parameter in process_bug.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS