CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
XMMS.pm in X2 XMMS Remote allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.
There is an off-by-one buffer overflow in spamc of SpamAssassin versions 2.40 through 2.43 when using BSMTP mode ('-B'). This allows remote attackers to execute arbitrary code via emails containing headers with leading '.' characters.
The SIP implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages.
TinyWeb 1.9 allows remote attackers to cause a denial of service (CPU consumption) via a '.%00.' in an HTTP GET request to the cgi-bin directory.
SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before version 3.9 allows remote attackers to execute arbitrary SQL commands.
Unspecified vulnerability in My Photo Gallery 3.5, and possibly earlier versions, has unknown impact and attack vectors.
RTS CryptoBuddy versions 1.0 and 1.2 use a weak encryption algorithm for the passphrase and generate predictable keys, making it easier for attackers to guess the passphrase.
A stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon versions 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
The rlm_smb module in FreeRADIUS 0.9.3 and earlier has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long User-Password attribute.
Buffer overflow in Web Agent Administration service in web-tools for SAP DB before version 7.4.03.30 allows remote attackers to execute arbitrary code via a long Name parameter to waadmin.wa.
Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.
SAP DB versions before 7.4.03.30 install several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases.
Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privileges.
Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ';' (semicolon) characters in escape sequences, leading to a buffer overflow.
PeopleSoft PeopleTools versions 8.1x, 8.2x, and 8.4x allow remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet. Attackers can guess the insufficiently random directory name and directly request access to the uploaded file.
The NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not properly enforce the sys:\etc\exports file when hostname aliases from the sys:etc\hosts file are used. This could allow users to mount file systems when XNFS should deny access for the host.
Buffer overflow in the WAECHO default service in web-tools in SAP DB before version 7.4.03.30 allows remote attackers to execute arbitrary code via a URL with a long requestURI.
Symantec PCAnywhere versions 10.x and 11, when started as a service, allow attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe.
Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable.
Buffer overflow in iwconfig, when installed setuid, allows local users to execute arbitrary code via a long OUT environment variable.