CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command parameter.
A signed integer overflow in the bttv_read function in the bttv driver in Linux kernel before 2.4.20 has unknown impact and attack vectors.
SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.
CUPS versions 1.1.14 through 1.1.17 do not properly check the return values of various file and socket operations. This could allow a remote attacker to cause a denial of service by exhausting resources.
Multiple buffer overflows in Winamp 3.0 when displaying an MP3 in the Media Library window allow remote attackers to execute arbitrary code via an MP3 file containing a long (1) Artist or (2) Album ID3v2 tag.
Multiple integer overflows in Common Unix Printing System (CUPS) versions 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via the CUPSd HTTP interface and the image handling code in CUPS filters.
In Common Unix Printing System (CUPS) versions 1.1.14 through 1.1.17, there is a vulnerability that does not properly check for zero-length GIF images. This allows remote attackers to execute arbitrary code via modified chunk headers.
CUPS versions 1.1.14 through 1.1.17 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by feeding negative arguments into memcpy() calls via HTTP requests with a negative Content-Length value or a negative length in chunked transfer encoding.
In Open WebMail version 1.81 and earlier, the openwebmail_init function allows local users to execute arbitrary code via .. (dot dot) sequences in a login name. Such a name is used in the sessionid parameter for the openwebmail-abook.pl script, leading to the discovery of a configuration file that specifies additional code to be executed.
CUPS versions 1.1.14 through 1.1.17 allow remote attackers to add printers without authentication via a certain UDP packet. This can lead to unauthorized activities such as stealing the local root certificate for the administration server.
The Portable Network Graphics (PNG) library libpng 1.2.5 and earlier incorrectly calculates offsets, allowing remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
CUPS versions 1.1.14 through 1.1.17 improperly use the strncat function when processing the options string, which can lead to a buffer overflow. This allows remote attackers to execute arbitrary code.
Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.
Buffer overflow in the Windows Shell function in Microsoft Windows XP allows remote attackers to execute arbitrary code via an .MP3 or .WMA audio file with a corrupt custom attribute.
Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code.
The COM_CHANGE_USER command in MySQL versions 3.x before 3.23.54 and 4.x up to 4.0.6 allows remote attackers to execute arbitrary code via a long response.
Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks.
Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code.
Multiple SSH2 servers and clients do not properly handle strings with null characters when the string length is specified by a length field. This could allow remote attackers to cause a denial of service or possibly execute arbitrary code.