CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflows in Pileup before 1.2 allow local users to gain root privileges via (1) long command line arguments, or (2) a long callsign.
Cross-site scripting vulnerability in CGIWrap before version 3.7 allows remote attackers to execute arbitrary Javascript on other web clients. Attackers can inject Javascript into error messages generated by CGIWrap.
The HTTP server for Cisco IOS versions 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands when local authorization is used by specifying a high access level in the URL.
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files.
The dnskeygen tool in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for an HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG). This allows attackers to obtain the keys and perform dynamic DNS updates.
An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.
Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone. Attackers can then use compiled HTML help (.chm) files to execute arbitrary programs.
Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.
The prepend.php3 file in PHPLib before version 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server.
The Horde Internet Messaging Program (IMP) before version 2.2.6 and 1.2.6 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript embedded in an email.
Buffer overflow in the Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.
Multiple buffer overflows in RADIUS daemon radiusd in (1) Merit 3.6b and (2) Lucent 2.1-2 allow remote attackers to cause a denial of service or execute arbitrary commands.
Buffer overflow in the Transparent Network Substrate (TNS) Listener in Oracle 8i version 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands STATUS, PING, SERVICES, TRC_FILE, SAVE_CONFIG, or RELOAD.
Default ECL in Lotus Notes before version 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email.
The telnet service in Microsoft Windows 2000 creates named pipes with predictable names and does not properly verify them, allowing local users to execute arbitrary commands.
Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a 'transfer job' routine.
The SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier accepts arbitrary community strings with requested MIB modifications, allowing remote attackers to obtain sensitive information such as WEP keys.
Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a .. (dot dot) attack.
Buffer overflows in the NetWin Authentication Module (NWAuth) version 3.0b and earlier could allow attackers to execute arbitrary code via long arguments to the -del or -lookup commands. This issue affects DMail, SurgeFTP, and possibly other packages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS