CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment.
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, allowing remote attackers to sniff passwords.
Buffer overflows in gzip versions 1.3x, 1.2.4, and others may allow attackers to execute code via a long file name. This could potentially occur remotely if gzip is run on an FTP server.
Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.
Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, causing Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions.
CVE-2001-1129 describes format string vulnerabilities in various components of Progress database 9.1C, allowing a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable.
Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, causing Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions.
Various Intrusion Detection Systems (IDS), including Cisco Secure IDS and Snort, allow remote attackers to evade detection of HTTP attacks via non-standard '%u' Unicode encoding of ASCII characters in the requested URL.
Internet Explorer 6 and earlier allows remote attackers to automatically execute certain HTTP requests that appear to come from the user. This could allow attackers to gain privileges or execute operations within web-based services.
CVE-2001-0717 describes a format string vulnerability in the ToolTalk database server rpc.ttdbserverd that allows remote attackers to execute arbitrary commands via format string specifiers passed to the syslog function.
Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed.
The rendering engine in Internet Explorer determines the MIME type independently of the type specified by the server, allowing remote servers to automatically execute scripts placed in files whose MIME type does not normally support scripting, such as text (.txt), JPEG (.jpg), etc.
Example applications in ColdFusion Server 4.x do not properly restrict access from outside the local host's domain, allowing remote attackers to upload, read, or execute files by spoofing the 'HTTP Host' variable.
Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable.
Vulnerability in Microsoft Excel 2002 and earlier and Microsoft PowerPoint 2002 and earlier allows attackers to bypass macro restrictions and execute arbitrary commands by modifying the data stream in the document.
RPM Package Manager versions 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when queried.
WebID in RSA Security SecurID 5.0, as used by ACE/Agent for Windows, Windows NT and Windows 2000, allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information.
Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 allows attackers to access restricted resources via URL-encoded (1) /.. or (2) \.. sequences.
Linux kernel versions 2.2.x through 2.2.19 and 2.4.x through 2.4.9 contain a vulnerability in the ptrace function that allows local users to gain root privileges. This can be achieved by running ptrace on a setuid or setgid program that calls an unprivileged program, such as newgrp.
CVE-2001-0792 in XChat 1.2.x has a format string vulnerability that allows remote attackers to execute arbitrary code via a malformed nickname.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS