CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in mIRC before version 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.
Buffer overflow in the IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.
In OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and PAM keyboard-interactive authentication is used, there is no delay after a root login attempt with the correct password. This makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful.
CVE-2003-1533 describes an SQL injection vulnerability in accesscontrol.php in PhpPass 2 that allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.
RTS CryptoBuddy versions 1.0 and 1.2 use a weak encryption algorithm for the passphrase and generate predictable keys, making it easier for attackers to guess the passphrase.
Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 may allow attackers to cause a denial of service or gain root privileges via unspecified vectors that trigger copy_from_user function calls with improper length arguments.
Buffer overflow in Epic Games Unreal Engine versions 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.
RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.
Buffer overflow in wall for HP-UX versions 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) version 1.2 allows remote attackers to execute arbitrary code via unknown vectors.
Unknown vulnerability in the Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to a memory allocation problem, has unknown impact.
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F, related to 'malicious script'.
Adiscon WinSyslog 4.21 SP1 is vulnerable to a denial of service attack that can be triggered by remote attackers sending long syslog messages.
Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.
Unspecified vulnerability in CDE dtmailpr of HP Tru64 versions 4.0F through 5.1B allows local users to gain privileges via unknown attack vectors.
Kerio Personal Firewall (KPF) version 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), allowing remote attackers to bypass the firewall filters.
The slashem-tty program in the FreeBSD Ports Collection is installed with write permissions for the games group, allowing local users with games group privileges to modify slashem-tty and execute arbitrary code as other users.
Aladdin Knowlege Systems eSafe Gateway version 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, allowing remote attackers to bypass virus protection.
DotBr version 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter in (1) exec.php3 or (2) system.php3.
DotBr 0.1 stores config.inc with insufficient access control under the web document root, allowing remote attackers to obtain sensitive information such as SQL usernames and passwords.