CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2002-1381 describes a format string vulnerability in daemon.c for Exim versions 4.x through 4.10 and 3.x through 3.36, allowing Exim administrative users to execute arbitrary code by modifying the pid_file_path value.
Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format (SWF).
Fetchmail versions 6.1.3 and earlier have a heap-based buffer overflow that does not account for the '@' character when determining buffer lengths for local addresses. This allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the (1) LMP, (2) PPP, or (3) TDS dissectors, possibly related to a missing field for EndVerifyAck messages.
The COM_CHANGE_USER command in MySQL versions 3.x before 3.23.54 and 4.x before 4.0.6 allows remote attackers to gain privileges via a brute force attack using a one-character password, causing MySQL to only compare the provided password against the first character of the real password.
The overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.
Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a web site or an HTML mail.
A vulnerability in the priocntl system call in Solaris allows local users to execute arbitrary code via '..' sequences in the pc_clname field of a pcinfo_t structure, causing priocntl to load a malicious kernel module.
The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.
The libmysqlclient client library in MySQL versions 3.x to 3.23.54 and 4.x to 4.0.6 does not properly verify length fields for certain responses in the read_rows and read_one_row routines. This may allow remote attackers to cause a denial of service and potentially execute arbitrary code.
The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, allowing remote attackers to cause an application crash.
Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via a long Transport field in a SETUP RTSP request, a DESCRIBE RTSP request with a long URL argument, or two simultaneous HTTP GET requests with long arguments.
Internet Explorer 5.5 and 6.0 does not perform complete security checks on external caching, allowing remote attackers to read arbitrary files.
Buffer overflow in the irw_through function for Canna 3.5b2 and earlier allows local users to execute arbitrary code as the bin user.
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code. These issues occur during user name canonicalization, during LDAP authentication, and due to an off-by-one error in the log writer.
An unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.
Multiple buffer overflows in RealOne and RealPlayer allow remote attackers to execute arbitrary code via a Synchronized Multimedia Integration Language (SMIL) file with a long parameter, a long filename in a rtsp:// request, or certain 'Now Playing' options on a downloaded file with a long filename.
Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code. This is a new variant of the certificate validation flaw that could enable identity spoofing.
Buffer overflow in samba versions 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption.