CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in bttlxeForum 2.0 beta 3 and earlier allows remote attackers to bypass authentication via the (1) username and (2) password fields, and possibly other fields.
A buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.
Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary code via a certain request to the HTTP receiver.
The gkrellm-newsticker plugin before version 0.3-3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI.
The handleAccept function in rinetd before version 0.62 does not properly resize the connection list when it becomes full, leading to incorrect array index settings. This allows remote attackers to cause denial of service and potentially execute arbitrary code via a large number of connections.
The plugin.ocx for Internet Explorer 5.01, 5.5, and 6.0 contains a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via the Load() method.
A stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a 'CREATE DATABASE LINK' query containing a long USING parameter.
Kerio Personal Firewall (KPF) version 2.1.4 and earlier allows remote attackers to execute administrator commands by sniffing packets from a valid session and replaying them against the remote administration server.
Buffer overflow in PostMethod() function for Monkey HTTP Daemon (monkeyd) 0.6.1 and earlier allows remote attackers to execute arbitrary code via a POST request with a large body.
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in Content-type and Content-encoding fields.
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to rawdocdata.asp or RawCustomSearchField.asp containing an embedded SQL statement.
The dupatch and setld utilities in HP Tru64 UNIX 5.1B PK1 and earlier allow local users to overwrite files and possibly gain root privileges via a symlink attack.
Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 improperly check parameters passed during third-party rendering, which could allow remote attackers to execute arbitrary web scripts.
Buffer overflow in the administration service (CSAdmin) for Cisco Secure ACS before version 3.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long user parameter to port 2002.
KDE 2 and KDE 3.1.1 and earlier 3.x versions allow attackers to execute arbitrary commands via PostScript (PS) or PDF files, due to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer.
Multiple buffer overflows in Samba before version 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service.
In MacOS X, DirectoryServices trusts the PATH environment variable to locate and execute the touch command, allowing local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.
The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet.
The xfsdump program in version xfsdq does not securely create quota information files, allowing local users to gain root privileges.
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, leading to a heap-based buffer overflow.