CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP-Nuke version 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator.
SEDUM 2.1 HTTP server allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.
Buffer overflow in sudo earlier than 1.6.3p6 allows local users to gain root privileges.
The pam_ldap authentication module in Solaris 8 allows remote attackers to bypass authentication by using a NULL password.
Buffer overflow in the pi program in PlanetIntra 2.5 allows remote attackers to execute arbitrary commands.
mailnews.cgi version 1.3 and earlier allows remote attackers to execute arbitrary commands via a user name that contains shell metacharacters.
Chili!Soft ASP for Linux before 3.6 does not properly set group privileges when running in inherited mode, which could allow attackers to gain privileges via malicious scripts.
Buffer overflow in Analog before version 4.16 allows remote attackers to execute arbitrary commands by using the ALIAS command to construct large strings.
In PHP-Nuke 4.4, the files bb_smilies.php and bbcode_ref.php allow remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. (dot dot) sequences into a malformed username argument.
UploadServlet in Bajie HTTP JServer 0.78, and possibly other versions before 0.80, allows remote attackers to execute arbitrary commands by uploading a program and then accessing the created file.
Oracle Java Virtual Machine (JVM) for version 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.
Buffer overflow in QNX RTP 5.60 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large number of arguments to the stat command.
Buffer overflow in qDecoder library version 5.08 and earlier, used in CGI programs like CrazyWWWBoard and CrazySearch, allows remote attackers to execute arbitrary commands via a long MIME Content-Type header.
Buffer overflow in SlimServe HTTPd 1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long HTTP GET request when the DebugLevel registry key is greater than 0.
CVE-2001-0180 affects the guestserver.cgi script, allowing remote attackers to execute arbitrary commands via shell metacharacters in the 'email' parameter.
Buffer overflow in Trend Micro Virus Buster 2001 version 8.00 allows remote attackers to cause a denial of service and potentially execute arbitrary commands via a large 'To' address.
Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP GET request.
Buffer overflow in the snmpXdmid daemon in Solaris allows remote attackers to execute arbitrary commands via a long 'indication' event.
Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS