CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The cdrecord program in cdrtools 2.0 has a format string vulnerability that allows local users to gain privileges via format string specifiers in the dev parameter.
The c-client IMAP Client, used in imap-2002b and Pine 4.53, allows remote malicious IMAP servers to cause a denial of service (crash) and possibly execute arbitrary code via certain large (1) literal and (2) mailbox size values that cause either integer signedness errors or integer overflow errors.
The mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address.
The IMAP Client for Mozilla 1.3 and 1.4a allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large literal and mailbox size values that cause either integer signedness errors or integer overflow errors.
An unknown vulnerability in GNU Ghostscript before version 7.07 allows attackers to execute arbitrary commands, even when -dSAFER is enabled, via a PostScript file that causes the commands to be executed from a malicious print job.
Konqueror Embedded and KDE 2.2.2 and earlier do not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
SQL injection vulnerability in register.asp in Snitz Forums 2000 before version 3.4.03, and possibly 3.4.07 and earlier, allows remote attackers to execute arbitrary stored procedures via the Email variable.
The FrontRange GoldMine mail agent in versions 5.70 and 6.00 before 30503 directly sends HTML to the default browser without setting its security zone or labeling it untrusted. This allows remote attackers to execute arbitrary code via a message rendered in IE using a less secure zone.
Multiple buffer overflows in ircII 20020912 allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via responses that are not properly fed to the my_strcat function by ctcp_buffer, cannot_join_channel, status_make_printable, create_server_list, and possibly other functions.
EPIC IRC Client (EPIC4) versions pre2.002, pre2.003, and possibly later versions allow remote malicious IRC servers to cause a denial of service (crash) and potentially execute arbitrary code via a CTCP request from a large nickname, leading to incorrect length calculation.
SQL injection vulnerability in ttForum allows remote attackers to execute arbitrary SQL and gain ttForum Administrator privileges via the Ignorelist-Textfield argument in the Preferences page.
Internet Explorer versions 5.01, 5.5, and 6.0 allow remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// requests, leading to multiple file download dialogs being opened.
IPSec in Mac OS X before version 10.2.6 does not properly handle certain incoming security policies that match by port. This could allow traffic that is not explicitly allowed by the policies.
CVE-2003-0188 vulnerability allows local users to execute arbitrary commands as other lv users by placing malicious .lv files in other directories.
The header.php file in ttCMS version 2.3 and earlier allows remote attackers to inject arbitrary PHP code by setting the ttcms_user_admin parameter to '1' and modifying the admin_root parameter to point to a URL containing a malicious header.inc.php script.
Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via various dissectors.
Buffer overflows in EPIC IRC Client (EPIC4) version 1.0.1 allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long replies not properly handled by the userhost_cmd_returned function or Statusbar capability.
Multiple buffer overflows in gPS before version 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to admin/admin.shtml containing a leading // (double slash).
Buffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter.