CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use RFC2231 encoding, which may be interpreted differently by mail clients.
In redhat-config-nfs before version 1.0.13, an unknown vulnerability when shares are exported to multiple hosts can cause incorrect permissions and prevent the all_squash option from being applied.
The calendar program in bsdmainutils versions 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, allowing attackers to execute arbitrary commands via a calendar event file.
A format string vulnerability in the auth_debug function in Courier-IMAP versions 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.
Vulnerability in DB2 8.1 allows local users to escalate privileges via the remote command server (DB2RCMD.EXE), which executes the db2rcmdc.exe program as the db2admin administrator. Attackers can exploit the DB2REMOTECMD named pipe to gain control.
Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
An integer overflow in Gaim before version 0.82 in the size variable of Groupware server messages allows remote attackers to cause a denial of service and possibly execute arbitrary code.
A stack-based buffer overflow in the xpm_extract_color function (io-xpm.c) of the XPM image decoder in gtk+ 2.4.4 and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a crafted color string.
A buffer overflow vulnerability in WIDCOMM Bluetooth Connectivity Software, used in products such as BTStackServer 1.3.2.7 and 1.4.2.10, Windows XP and Windows 98 with MSI Bluetooth Dongles, and HP IPAQ 5450 running WinCE 3.0, allows remote attackers to execute arbitrary code via specially crafted service requests.
Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.
Unknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges.
Vulnerability in SalesLogix 6.1 allows remote authenticated users to create arbitrary files and execute code by manipulating the vMME.AttachmentPath or vMME.LibraryPath variables, which are used to specify file write paths.
SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the 'id' parameter in a view operation.
A buffer overflow vulnerability in MailCarrier 2.51 occurs when handling EHLO and possibly HELO commands. A remote attacker can exploit this to execute arbitrary code on the server.
A directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (dot dot) in the op parameter.
SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.
Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.
The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a direct HTTP request to app_sta.stm.
Vulnerability in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 allows remote attackers to delete or move arbitrary files on the server via the originalfolder and messageid parameters in viewaction.html.
Vulnerability in attachment.html of Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request.