CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Microsoft Java implementation, as used in Internet Explorer, allows remote attackers to steal cookies and execute script in a different security context via a URL that contains a colon in the domain portion.
Buffer overflows in the DNS stub resolver library in ISC BIND from versions 4.9.2 to 4.9.10 and other derived libraries such as BSD libc and GNU glibc allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the getnetbyname or getnetbyaddr functions.
SSH Secure Shell for Servers and Workstations versions 2.0.13 through 3.2.1, when running without a PTY, does not call setsid, allowing attackers to gain certain privileges.
Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client versions 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.
SQL injection vulnerability in PHP-Nuke before version 6.0 allows remote authenticated users to modify the database and gain privileges via the 'bio' argument to modules.php.
Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via 'unsanitized input.'
Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE that points to code stored on a remote server, which is then used in (1) index.php, (2) install.php, or (3) various test_*.php scripts.
A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, allowing attackers with only write permissions to upload malicious .COM files.
Buffer overflow in Abuse 2.00 and earlier allows local users to gain root privileges via a long -net command line argument.
Abuse 2.00 and earlier allows local users to gain privileges via command line arguments that specify alternate Lisp scripts that run at escalated privileges.
Buffer overflow in Window Maker (wmaker) version 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a specially crafted image file that is not properly handled when allocating a buffer based on width and height information.
QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to locate and execute the cp program with raised privileges, allowing local users to gain elevated privileges by modifying the PATH to point to a malicious cp program.
Buffer overflow in log2mail before version 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.
CVE-2002-1244 describes a format string vulnerability in Pablo FTP Server versions 1.5, 1.3, and possibly others. It allows remote attackers to cause a denial of service and potentially execute arbitrary code via format strings in the USER command.
Peter Sandvik's Simple Web Server 0.5.1 and earlier allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
An unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) versions 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges.
The Mail::Mailer module in the perl-MailTools package version 1.47 and earlier uses mailx as the default mailer, allowing remote attackers to execute arbitrary commands by inserting them into the mail body.
Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, allowing local users to modify /dev/mem and gain privileges via a modified PATH environment variable pointing to a Trojan horse gzip program.
The mailconf module in Linuxconf version 1.24 and earlier on Conectiva Linux 6.0 through 8 generates the Sendmail configuration file (sendmail.cf) in a way that configures Sendmail as an open mail relay, allowing remote attackers to send spam.