CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.
LICQ versions 1.2.6, 1.0.3, and possibly others have a format string vulnerability that allows remote attackers to perform unknown actions via format string specifiers.
PHP treats unknown methods such as 'PoSt' as GET requests, which could allow attackers to bypass intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0.
Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 may allow attackers to cause a denial of service or gain root privileges via unspecified vectors that trigger copy_from_user function calls with improper length arguments.
iisPROTECT versions 2.1 and 2.2 allow remote attackers to bypass authentication via an HTTP request containing URL-encoded characters.
Buffer overflow in Epic Games Unreal Engine versions 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.
DotBr 0.1 stores config.inc with insufficient access control under the web document root, allowing remote attackers to obtain sensitive information such as SQL usernames and passwords.
DotBr version 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter in (1) exec.php3 or (2) system.php3.
Aladdin Knowlege Systems eSafe Gateway version 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, allowing remote attackers to bypass virus protection.
The slashem-tty program in the FreeBSD Ports Collection is installed with write permissions for the games group, allowing local users with games group privileges to modify slashem-tty and execute arbitrary code as other users.
Kerio Personal Firewall (KPF) version 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), allowing remote attackers to bypass the firewall filters.
Unspecified vulnerability in CDE dtmailpr of HP Tru64 versions 4.0F through 5.1B allows local users to gain privileges via unknown attack vectors.
Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.
Adiscon WinSyslog 4.21 SP1 is vulnerable to a denial of service attack that can be triggered by remote attackers sending long syslog messages.
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F, related to 'malicious script'.
Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) versions 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via a client with a long hostname.
Buffer overflow in wall for HP-UX versions 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
Aprelium Technologies Abyss Web Server version 1.1.2, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty Connection or Range fields.
Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) versions 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.
Incorrect file handling in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 may allow attackers to gain access or cause a denial of service.