CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.
Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.
Buffer overflow vulnerability in the getauthfromURL function in httpget.c in mpg123 before version 0.59s and mpg123 0.59r. An attacker can remotely or locally execute arbitrary code via an mp3 file containing a long string before the @ sign in a URL.
The vulnerability in the stmkfont tool in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.
Buffer overflow vulnerability in the get_tag function in mod_include for Apache 1.3.x through 1.3.32. Local users who can create SSI (XSSI) documents can exploit a length calculation error to execute arbitrary code as the apache user.
A vulnerability in Sophos Anti-Virus before version 3.87.0 and the version for Windows 95, 98, and Me before 3.88.0 allows a remote attacker to bypass antivirus protection via a compressed file with both local and global headers set to zero. Such a file can be opened on the target system without being detected by the antivirus software.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.
Format string vulnerability in ez-ipupdate.c for ez-ipupdate versions 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types, allows remote servers to execute arbitrary code.
Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.
Buffer overflow in Zinf 2.2.1 on Windows and other older versions for Linux allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.
Apple Remote Desktop Client 1.2.4 executes a GUI application as root when started by an Apple Remote Desktop Administrator application, allowing remote authenticated users to execute arbitrary code when loginwindow is active via Fast User Switching.
The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.
Buffer overflow vulnerability in Microsoft Office XP allows remote attackers to execute arbitrary code via a specially crafted link with long inputs after '%00' (null byte) in .doc filenames or '%0a' (carriage return) in .rtf filenames.
The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
A heap-based buffer overflow in the DEC2EXE module of the Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset in a crafted PE header.
Multiple buffer overflows in the enable command for SCO OpenServer 5.0.6 and 5.0.7 allow local users to execute arbitrary code via long command line arguments.
Format string vulnerability in the movemail utility in Emacs 20.x, 21.3, and possibly other versions, and XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.
Format string vulnerability in the Log_Resolver function in log.c in ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.
PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via URL manipulation.
A buffer overflow vulnerability in the socket_getline function in Newspost 2.1.1 and earlier allows a remote malicious NNTP server to execute arbitrary code via a long string without a newline character.