CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
A buffer overflow vulnerability in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows a local user to gain privileges via a specially crafted application.
Multiple vulnerabilities in fliccd, installed setuid root as part of the kdeedu Kstars support for INDI in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
A format string vulnerability in IDA Pro 4.7.0.830 allows remote or local attackers to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a DLL name.
Buffer overflow vulnerability in Computer Associates (CA) License Client version 0.1.0.15. A remote attacker can send a specially crafted PUTOLF request with a long filename, leading to arbitrary code execution.
A format string vulnerability in Xpand Rally version 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
The Hyperlink Object Library in Windows 98, 2000, XP, and Server 2003 contains a buffer overflow that can be exploited by a remote attacker to execute arbitrary code via a crafted link.
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the 'DHTML Method Heap Memory Corruption Vulnerability'.
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the 'Server Message Block Vulnerability,' and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the path_prefix parameter to reference a URL on a remote web server that contains the code.
PHP remote file inclusion vulnerability in install.php of mcNews version 1.3 and earlier. An attacker can modify the 'l' parameter to point to a remote server containing malicious PHP code, allowing its execution on the victim's server.
A format string vulnerability in the log_do function in log.c in YepYep mtftpd 0.0.3, when the statistics option is enabled, allows remote attackers to execute arbitrary code via the CWD command.
PHP remote file inclusion vulnerability in news.php in ModernBill 4.3.0 and earlier allows remote attackers to execute arbitrary PHP code by modifying the DIR parameter to reference a URL on a remote web server that contains the code.
An unknown vulnerability in the Microsoft Jet database engine (msjet40.dll) version 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted .mdb file.
Vulnerability in poppassd_pam 1.0 and earlier allows remote attackers to change passwords for arbitrary users without verifying the old password.
The vulnerability in NotifyLink allows a remote attacker to obtain AES keys via a direct request to /hwp/get.asp. Additionally, the weak encryption scheme (fixed byte reordering) enables key recovery through brute force.
Unknown vulnerability in Webmin and Usermin before version 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
A heap-based buffer overflow in psd.c in ImageMagick versions 6.1.0, 6.1.7, and earlier allows remote attackers to execute arbitrary code via a specially crafted .PSD image file with a large number of layers.
A format string vulnerability in the a_Interface_msg function in Dillo before version 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.