CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CGI counter version 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.
The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, allowing an attacker to download any type of file to a user's system by encoding it within an email message or news post.
The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, allowing them to modify user accounts or web pages.
The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers.
Buffer overflow in the Solaris netpr program allows local users to execute arbitrary commands via a long -p option.
The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker to recover it and use it to decrypt EFS data.
The Office 2000 UA ActiveX Control is marked as 'safe for scripting,' allowing remote attackers to conduct unauthorized activities via the 'Show Me' function in Office Help.
The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.
The vulnerability in ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by sending a request to the file with a large number of encoded spaces (%20) and ending with a .htr extension.
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the device's MAC address. This could allow remote attackers to gain root access.
Buffer overflow in the SMTP gateway for InterScan Virus Wall 3.32 and earlier allows a remote attacker to execute arbitrary commands via a long filename for a uuencoded attachment.
Buffer overflow in the Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.
Buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8 allows remote attackers to execute arbitrary commands.
The pam_console module in Linux systems performs a chown on various devices upon user login. An open file descriptor for those devices can remain active after the user logs out, allowing that user to sniff activity on these devices when subsequent users log in.
The resolver in glibc 2.1.3 uses predictable IDs, allowing a local attacker to spoof DNS query results.
Buffer overflow in Sniffit 0.3.x with the -L logging option enabled allows remote attackers to execute arbitrary commands via a long MAIL FROM mail header.
FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email.
Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields.
Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string.
Buffer overflow in WebShield SMTP 4.5.44 allows remote attackers to execute arbitrary commands via a long configuration parameter to the WebShield remote management service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS