CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVS versions from 1.11.x to 1.11.16 and from 1.12.x to 1.12.8 improperly handle empty data lines, which may allow remote attackers to perform an out-of-bounds write. This can lead to arbitrary code execution or modification of critical program data.
CVS versions 1.12.x through 1.12.8 and 1.11.x through 1.11.16 do not properly handle malformed 'Entry' lines. This may lead to a NULL terminator not being used, resulting in a denial of service (crash), modification of critical program data, or arbitrary code execution.
A vulnerability in the 'memory dump' command in the VICE emulator versions 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and potentially execute arbitrary code via format string specifiers in an output string.
The Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access.
Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbitrary files via .. (dot dot) and // (double slash) sequences in the filename parameter.
The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as proftpdvhosts or addalink.cgi. This is a different vulnerability than CVE-2004-0490.
The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.
Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool.
Heap-based buffer overflow in proxy_util.c of mod_proxy in Apache 1.3.25 to 1.3.31. A remote attacker can send an HTTP Content-Length header with a negative value, causing large data copying and leading to process crash or potential arbitrary code execution.
Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.
Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.
Vulnerability in page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.
The syssgi SGI_IOPROBE system call in IRIX 6.5.20 through 6.5.24 allows local users to gain privileges by reading and writing to kernel memory.
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10 allows remote attackers to read and delete arbitrary files via '..' sequences in the dynamicimag argument to crystalimagehandler.aspx.
The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly leading to a buffer overflow.
A stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0 allows local or remote attackers to execute arbitrary code via a .job file containing long parameters.
The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.
libsvn_ra_svn in Subversion 1.0.4 trusts the length field of svn protocol URLs, allowing remote attackers to cause a denial of service through a heap-based buffer overflow.
Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.
The vulnerability in eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.