CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements.
Buffer overflow in dtprintinfo on HP-UX 11.00, and possibly other operating systems, allows local users to gain root privileges via a long DISPLAY environment variable.
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a 'data' tag pointing to the malicious code.
A double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.
ProFTPD versions 1.2.7 through 1.2.9rc2 do not properly translate newline characters when transferring files in ASCII mode, allowing remote attackers to execute arbitrary code via a buffer overflow using certain files.
The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration. This differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.
Buffer overflow in the log viewing interface in Perception LiteServe versions 1.25 through 2.2 allows remote attackers to execute arbitrary code via a GET request with a long file name.
Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.
Mail in Mac OS X before version 10.3, when configured to use MD5 Challenge Response, uses plaintext authentication if the CRAM-MD5 hashed login fails. This could allow remote attackers to sniff passwords.
An unknown vulnerability in QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3 allows attackers to gain unauthorized access to a system.
Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, allowing local users to gain elevated privileges.
CVE-2002-1570 describes a heap-based buffer overflow in the snmpnetstat driver for ucd-snmp version 4.2.3 and earlier, as well as net-snmp. Remote attackers can execute arbitrary code by sending multiple getnextrequest PDU messages with conflicting ifindex variables, causing snmpnetstat to write variable data past the end of an array.
NFS in SGI versions 6.5.21m and 6.5.21f does not perform access checks in certain configurations when an /etc/exports entry uses wildcards without any hostnames or groups, potentially allowing attackers to bypass intended restrictions.
IA WebMail Server 3.1.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long GET request.
Buffer overflow in the defang function in libhttpd.c for thttpd versions 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests containing '<' or '>' characters, which trigger the overflow when the characters are expanded to '<' and '>' sequences.
Pan version 0.13.3 and earlier allows remote attackers to cause a denial of service (crash) via a news post with a long author email address.
Buffer overflow in to_ascii for PostgreSQL 7.2.x and 7.3.x before 7.3.4 allows remote attackers to execute arbitrary code.
Multiple stack-based buffer overflows in mod_alias and mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files that can lead to denial of service or execute arbitrary code.
Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vectors including Admin-Center, Announcements, admin/calendar.php, and showevent.php.
Multiple SQL injection vulnerabilities in the Portal DB components, including List of Values, Forms, Hierarchy, and XML components in Oracle9i Application Server allow remote attackers to execute arbitrary SQL commands via the URL.