CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow exists in the WeOnlyDo wodSSHServer ActiveX Component versions 1.2.7 and 1.3.3 DEMO, also used in FreeSSHd 1.0.9 and freeFTPd 1.0.10. Remote attackers can exploit a long key exchange algorithm string to execute arbitrary code.
A buffer overflow vulnerability in EMC Retrospect Client versions 5.1 through 7.5 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a crafted packet to port 497.
A stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a data_file_request command with a long type or name string.
In Outgun 1.0.3 bot 2 and earlier, the leetnet functions (leetnet/rudp.cpp) contain a buffer over-read vulnerability. A remote attacker can send packets with incorrect message sizes, causing an application crash (denial of service).
In Outgun 1.0.3 bot 2 and earlier, the leetnet functions (leetnet/rudp.cpp) improperly handle large packets, allowing a remote attacker to cause an exception and interrupt the game (denial of service).
A buffer overflow vulnerability in FileZilla before version 2.2.23 allows remote attackers to execute arbitrary code via unknown attack vectors.
RealVNC 4.1.1 and other products using it (e.g., AdderLink IP, Cisco CallManager) allow a remote attacker to bypass authentication by sending a request with an insecure security type ("Type 1 - None"), which is accepted even if not offered by the server. The attack was originally demonstrated using a long password.
A PHP remote file inclusion vulnerability exists in pafiledb_constants.php within the Download Manager (mxBB pafiledb) integration used with phpBB. Attackers can exploit the module_root_path parameter to execute arbitrary PHP code remotely.
SQL injection vulnerability in charts.php of the Chart mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
A buffer overflow vulnerability was found in the getsym function in tekhex.c of libbfd in GNU Binutils before 20060423, as used by GNU strings. This allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Tektronix Hex Format (TekHex) record where the length character is not a valid hexadecimal character.
A vulnerability in QuickTime Streaming Server on Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) by sending a QuickTime movie with a missing track, triggering a null pointer dereference.
A vulnerability in the Mail application on Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code by sending an enriched text email message with invalid color information, causing Mail to allocate and initialize arbitrary classes.
In Apple Mac OS X 10.3.9 and 10.4.6, the bundle API in CoreFoundation loads dynamic libraries even if the client application has not directly requested it. This allows attackers to execute arbitrary code from an untrusted bundle.
In Apple Mac OS X 10.3.9 and 10.4.6, the Mail application contains an integer overflow when processing MacMIME encapsulated attachments. A remote attacker can exploit this vulnerability to execute arbitrary code via a crafted attachment.
An integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding.
MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the provided 'New MySQL root password', leaving the MySQL root password blank. This allows local users to gain full privileges to that database.
A buffer overflow in QuickTime Streaming Server on Apple Mac OS X 10.3.9 and 10.4.6 occurs when processing a crafted RTSP request during message logging. This allows a remote attacker to execute arbitrary code.
A heap-based buffer overflow in Apple QuickTime before version 7.1 in the ReadBMP function allows remote attackers to execute arbitrary code via a crafted BMP file. This issue was originally part of CVE-2006-1983 but is now a separate CVE.
IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.
In vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, a remote attacker can authenticate to an account that does not have a cleartext password set by using a blank password for SMTP AUTH or APOP.