CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the w3-msql CGI program in the miniSQL package allows remote attackers to execute commands.
The whois.cgi program in WebWho+ allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly.
The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.
glFtpD includes a default glftpd user account with a default password and a UID of 0.
glFtpD allows local users to gain privileges via metacharacters in the SITE ZIPCHK command.
Buffer overflow in ZBServer Pro 1.50 allows remote attackers to execute commands via a long GET request.
The default configurations for McAfee Virus Scan and Norton Anti-Virus do not scan files in the RECYCLED folder used by the Windows Recycle Bin. This allows attackers to store malicious code undetected.
A vulnerability in Solaris allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.
wmmon in FreeBSD allows local users to gain privileges via the .wmmonrc configuration file.
Buffer overflow in the Linux linuxconf package allows remote attackers to gain root privileges via a long parameter.
Buffer overflow in the i2odialogd daemon on UnixWare allows remote attackers to gain root access via a long username/password authorization string.
Ipswitch IMail versions 5.0 and 6.0 use weak encryption to store passwords in registry keys, allowing local attackers to read passwords for e-mail accounts.
wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.
Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID.
Buffer overflow in Infoseek Ultraseek search engine allows remote attackers to execute commands via a long GET request.
The vulnerability in classifieds.cgi allows remote attackers to execute arbitrary commands by specifying them in a hidden variable in a CGI form.
The daynad program in Intel InBusiness E-mail Station does not require authentication, allowing remote attackers to modify its configuration, delete files, or read mail.
Modifications to Access Control Lists (ACLs) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.
Buffer overflow in VDO Live Player allows remote attackers to execute commands on the VDO client via a malformed .vdo file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS