CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 use weak encryption in the users.cfg, settings.cfg, users.dat, and user.dat files, allowing local users to extract passwords.
The vulnerability in the 'at' commands on Mac OS X 10.3.7 and earlier is due to improper privilege dropping. This allows a local user to delete arbitrary files via atrm, execute arbitrary programs, or read arbitrary files using the -f argument to batch.
Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument.
The vulnerability in Squid 2.5 involves incorrect processing of empty Access Control Lists (ACLs) during configuration file parsing, particularly proxy_auth ACLs without defined auth schemes, which effectively removes arguments and could allow remote attackers to bypass intended ACLs if the administrator ignores parser warnings.
A heap-based buffer overflow in multiple F-Secure Anti-Virus and Internet Security products allows remote attackers to execute arbitrary code via a crafted ARJ archive.
A vulnerability in Netfilter in Linux kernel 2.6.8.1 allows a remote attacker to cause a denial of service (kernel crash) via crafted IP packet fragments.
A vulnerability in Microsoft Windows systems allows a remote attacker to cause a denial of service and potentially execute arbitrary code by sending crafted IP packets with malformed options. This flaw affects Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems.
Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in the loadplugin parameter.
Multiple buffer overflows in Xzabite DYNDNSUpdate 0.6.15 and earlier, including the ipcheck function in dyndnsupdate.c, allow remote attackers who spoof a dyndns.org server to execute arbitrary code via unknown vectors.
The vulnerability in mod_python version 2.7.8 and earlier allows a remote attacker to access restricted objects via a crafted URL.
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the 'Input Validation Vulnerability.'
A vulnerability in Windows 2000, XP, and Server 2003 due to improper validation of memory regions for COM structured storage files allows an attacker to execute arbitrary code via a specially crafted file.
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
A format string vulnerability in the a_Interface_msg function in Dillo before version 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
A heap-based buffer overflow in psd.c in ImageMagick versions 6.1.0, 6.1.7, and earlier allows remote attackers to execute arbitrary code via a specially crafted .PSD image file with a large number of layers.
The License Logging service in Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate message length, leading to an unchecked buffer. A remote attacker can exploit this to cause a denial of service (crash) and potentially execute arbitrary code.
The vulnerability in ncpfs before version 2.2.6 is that the nwclient.c file does not drop root privileges before executing utilities using the NetWare client functions. This allows local users to escalate their privileges.
The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information about users accessing resources via anonymous logon using a named pipe that is not properly authenticated, known as the Named Pipe Vulnerability.