CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, allowing remote attackers to create a server on the victim's system via a malicious applet.
Linux Intrusion Detection System (LIDS) version 0.9.7 allows local users to gain root privileges when LIDS is disabled via the security=0 boot option.
The xpdf PDF viewer client earlier than version 0.91 does not properly launch a web browser for embedded URLs, allowing an attacker to execute arbitrary commands via a URL containing shell metacharacters.
The telnetd telnet server in IRIX versions 5.2 through 6.1 does not properly clean user-injected format strings, allowing remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request.
The admin.php3 file in PHP-Nuke does not properly verify the administrator password, allowing remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameters.
The logrotate script for OpenLDAP before version 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon (klogd), causing it to terminate.
Buffer overflow in the bdf program in HP-UX 11.00 may allow local users to gain root privileges via a long -t option.
Buffer overflow in the IBM Net.Data db2www CGI program allows remote attackers to execute arbitrary commands via a long PATH_INFO environmental variable.
A format string vulnerability in the strong.exe program in NAI Net Tools PKI server 1.0 before HotFix 3 allows remote attackers to execute arbitrary code via format strings in a URL with a .XUDA extension.
The xlockmore and xlockf programs do not properly cleanse user-injected format strings, allowing local users to gain root privileges via the -d option.
Buffer overflow in dmplay in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long command line option.
The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, allowing remote attackers to add user accounts by directly calling the admin CGI script.
The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, allowing remote attackers to spoof the eTrust administrator and gain privileges.
Umb-scheme version 3.2-11 for Red Hat Linux is installed with world-writable files.
Buffer overflow in Adobe Acrobat 4.05, Reader, Business Tools, and Fill In products that handle PDF files allows attackers to execute arbitrary commands via a long /Registry or /Ordering specifier.
Buffer overflow in Trivial HTTP (THTTPd) allows remote attackers to cause a denial of service or execute arbitrary commands via a long If-Modified-Since header.
The net.init rc script in HP-UX 11.00 allows local users to overwrite arbitrary files via a symlink attack that points from /tmp/stcp.conf to the targeted file.
The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands.
Buffer overflow in SGI Omron WorldView Wnn allows remote attackers to execute arbitrary commands via long JS_OPEN, JS_MKDIR, or JS_FILE_INFO commands.
Buffer overflow in vqSoft vqServer 1.4.49 allows remote attackers to cause a denial of service or possibly gain privileges via a long HTTP GET request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS