CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Linksys EtherFast Cable/DSL BEFSR11, BEFSR41, and BEFSRU31 with firmware 1.42.7 opens TCP port 5678 for remote administration even when the 'Block WAN' and 'Remote Admin' options are disabled.
PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to backend.php, screen.php, or admin/modules/comment.php.
Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server.
The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS versions 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.
Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
Buffer overflow in ssldump 0.9b2 and earlier, when running in decryption mode, allows remote attackers to execute arbitrary code via a long RSA PreMasterSecret.
The default --checksig setting in RPM Package Manager 4.0.4 checks that a package's signature is valid without listing who signed it. This can allow remote attackers to make it appear that a malicious package comes from a trusted source.
cgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request.
The EIGRP protocol, implemented in Cisco IOS versions 11.3 through 12.2, allows remote attackers to cause a denial of service by sending a large number of spoofed EIGRP neighbor announcements, resulting in an ARP storm on the local network.
The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service through a long username with multiple /localhost entries.
Buffer overflow in the Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long username or password.
FTGate and FTGate Pro version 1.05 lock user mailboxes before successful authentication, allowing remote attackers to lock the mailboxes of other users.
Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll extended stored procedure or (2) a long database name argument to the DBCC CHECKVERIFY function.
FormMail version 1.9 and earlier allows remote attackers to bypass the HTTP_REFERER check, enabling unauthorized activities.
Bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file.
The default configuration of MySQL versions 3.20.32 through 3.23.52 on Windows sets the bind address to the loopback interface, allowing remote attackers to connect to the database.
Buffer overflow in the netlog function in pen.c for Pen 0.9.1 and 0.9.2 allows remote attackers to execute arbitrary commands via malformed log messages.
CVE-2002-1885 is a remote file inclusion vulnerability in PowerPhlogger (PPhlogger) versions 2.0.9 through 2.2.2 in showhits.php3, allowing remote attackers to execute arbitrary PHP code via the rel_path parameter.
SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter.