CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in Oracle 9i before version 9.2.0.3 allow local users to execute arbitrary code. This can be achieved by setting the TIME_ZONE session parameter to a long value or providing long parameters to the NUMTOYMINTERVAL, NUMTODSINTERVAL, or FROM_TZ functions.
The Postfix server in Apple Mac OS X 10.3.6, when using CRAM-MD5 authentication, allows remote attackers to send mail without authentication by replaying captured authentication information.
Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
Buffer overflow vulnerability in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.
An unknown vulnerability in Cisco ONS 15327 before version 4.1(3), ONS 15454 before version 4.6(1), ONS 15454 SD before version 4.1(3), and Cisco ONS15600 before version 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.
SL Mail Pro 2.0.9 and earlier versions have a stack-based buffer overflow in Supervisor Report Center that allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.
SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
A stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
In versions 1.6.10 to 1.6.15 of the Eggheads Eggdrop IRC bot, the Share.mod component may mistakenly assign STAT_OFFERED status to a bot that is not a sharebot. This allows remote attackers to use this status to promote a bot to a sharebot and conduct unauthorized activities.
Load Sharing Facility (LSF) versions 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user. This could allow remote attackers within the local cluster to gain privileges.
The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer.
Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.
Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via user.dll, loadpageadmin.dll, or loadpageuser.dll.
Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
CVE-2004-0277 in Dream FTP 1.02 has a format string vulnerability that allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via format string specifiers in the username.
Multiple buffer overflows in the auth_ident() function in auth.c for GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.