CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in SLWebMail 3 on Windows systems allow remote attackers to cause a denial of service and possibly execute arbitrary code via long Language and CompanyID parameters in various DLL files.
The GnuPG plugin in kopete before version 0.6.2 does not properly cleanse the command line when executing gpg, allowing remote attackers to execute arbitrary commands.
A vulnerability in the POP3 client for Mirabilis ICQ Pro 2003a allows remote malicious servers to execute arbitrary code via format strings in the response to a UIDL command.
The 'ICQ Features on Demand' functionality for Mirabilis ICQ Pro 2003a does not properly verify the authenticity of software upgrades, allowing remote attackers to install arbitrary software via a spoofing attack.
Multiple buffer overflows in Floosietek FTGate Pro Mail Server (FTGatePro) version 1.22 allow remote attackers to execute arbitrary code via long MAIL FROM or RCPT TO commands.
Buffer overflow in Personal FTP Server allows remote attackers to execute arbitrary code via a long USER argument.
Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client versions 3.5.x through 4.0.REL, when enabling IPSec over TCP for a port, allow remote attackers to access the private network without authentication.
Integer signedness errors in the POP3 client for Mirabilis ICQ Pro 2003a allow remote attackers to execute arbitrary code via the (1) Subject or (2) Date headers.
The admin.php file in miniPortail allows remote attackers to gain administrative privileges by setting the miniPortailAdmin cookie to an 'adminok' value.
Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value.
The key validation code in GnuPG before version 1.2.2 improperly assesses the validity of keys with multiple user IDs, assigning the highest validity to the most valid user ID. This prevents GnuPG from warning the encrypting user when a user ID lacks a trusted path.
In Slackware 9.0, the rc.M script calls quotacheck with the -M option, which causes the filesystem to be remounted and potentially resets security-relevant mount flags such as nosuid, nodev, and noexec.
Multiple heap-based buffer overflows in WsMp3 daemon (WsMp3d) 0.0.10 and earlier allow remote attackers to execute arbitrary code via long HTTP requests.
Demarc Puresecure 1.6 stores authentication information for the logging server in plaintext, allowing attackers to steal login names and passwords to gain privileges.
Multiple buffer overflows in kermit in HP-UX 10.20 and 11.00 allow local users to gain privileges via long arguments to ask, askq, define, assign, and getc.
The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges.
An unknown vulnerability in Cisco Catalyst 7.5(1) allows local users to bypass authentication and gain access to the enable mode without a password.
The ctrlpacket.c file in the PoPToP PPTP server before version 1.1.4-b3 has a vulnerability that allows remote attackers to cause a denial of service by setting the length field to 0 or 1. This leads to a negative value being fed into a read operation, resulting in a buffer overflow.
The plugin.ocx for Internet Explorer 5.01, 5.5, and 6.0 contains a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via the Load() method.
A stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a 'CREATE DATABASE LINK' query containing a long USING parameter.