CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a negative add_dsa_buf_bytes variable, which leads to a buffer overflow.
The check_scramble_323 function in MySQL 4.1.x before 4.1.3 and MySQL 5.0 allows remote attackers to bypass authentication by sending a zero-length scrambled string.
A format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
The vulnerability in the gzexe tool in gzip version 1.3.3 and earlier causes the execution of an argument when the creation of a temporary file fails, instead of exiting the program. This could allow remote attackers or local users to execute arbitrary commands.
SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.
Vulnerability in osTicket allows remote attackers to view sensitive uploaded files and potentially execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifying the id parameter to reference a URL on a remote web server that contains the code.
Vulnerability in FreeS/WAN 1.x and 2.x and related products (superfreeswan 1.x, openswan before 1.0.6 and 2.1.4, strongSwan before 2.1.3) allows remote attackers to authenticate using spoofed PKCS#7 certificates. A self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file.
An unknown vulnerability in the 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication through repeated login attempts using any username and password.
Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.
A vulnerability in Mailreader.com 2.3.30 and 2.3.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
Buffer overflow in cgi.c in www-sql before version 0.5.7 allows local users to execute arbitrary code via a web page processed by www-sql.
The vulnerability in admin.php of Newsletter ZWS allows a remote attacker to gain administrative privileges by performing a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
A vulnerability in the Unreal Engine allows remote attackers to execute arbitrary code by sending a UDP packet with a long value in a secure query, causing memory overwrite. It affects multiple games including Unreal Tournament 2004, DeusEx, and Postal 2.
A stack-based buffer overflow in MySQL 4.1.x before 4.1.3 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string.
Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory. These are different vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool.
The eay_check_x509cert function in KAME Racoon incorrectly validates certificates even when OpenSSL validation fails, allowing remote attackers to bypass authentication.
Multiple format string vulnerabilities in the logquit, logerr, or loginfo functions in Software Upgrade Protocol (SUP) allow remote attackers to execute arbitrary code via format string specifiers in messages logged by syslog.
The vulnerability in Apache for Apple Mac OS X 10.2.8 and 10.3.6 stems from a case sensitivity mismatch between the server and the HFS+ filesystem. Apache restricts access to files only with exact case matching, while HFS+ treats them case-insensitively, allowing attackers to bypass restrictions.