CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick.
Cisco Personal Assistant versions 1.4(1) and 1.4(2) disables password authentication when 'Allow Only Cisco CallManager Users' is enabled, allowing remote attackers to gain access with a valid username.
Internet Explorer versions 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.
The GUI functionality for an interactive session in Symantec LiveUpdate versions 1.70.x through 1.90.x, used in Norton Internet Security and SystemWorks and AntiVirus from 2001 to 2004, allows local users to gain SYSTEM privileges.
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's 'href' to the malicious Javascript, then calling execCommand('Refresh') to refresh the page.
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by modifying the createTextRange or createRange method. Exploitation of these vulnerabilities may lead to unauthorized access to data.
The secldapclntd daemon in AIX 4.3, 5.1, and 5.2 uses an Internet socket for communication with the loadmodule, allowing remote attackers to directly connect to the daemon and conduct unauthorized activities.
Buffer overflow vulnerability in the WTHoster and WebDriver modules in WildTangent Web Driver 4.0 allows remote attackers to execute arbitrary code via a long filename.
Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users with DSA privileges to execute arbitrary code via a long ONCONFIG environment variable.
The default installation of Cisco voice products on IBM servers running OS earlier than 2000.2.6 with the IBM Director Agent does not require authentication, allowing remote attackers to gain administrator privileges by connecting to TCP port 14247.
An unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users and gain privileges.
Internet Explorer versions 5.01 through 6 SP1 allow remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible.
A PHP remote file inclusion vulnerability in PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server containing the code.
mpg321 version 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability.
Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allow remote web servers to execute arbitrary code via certain long strings.
A stack-based buffer overflow in vfs_s_resolve_symlink of Midnight Commander (mc) version 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.
Internet Explorer versions 5.01 through 6 SP1 allow remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame. When the history.back function is called, this URL is added to the history list and executed in the top window's zone.
The mremap system call in Linux kernel 2.4.x before version 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, allowing local users to cause a denial of service and possibly gain privileges by remapping a virtual memory area.
Buffer overflow in fsp before version 2.81.b18 allows remote users to execute arbitrary code.
The parseAddress code in SquirrelMail 1.4.0 and GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the 'To:' field.