CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors.
The kadm_ser_in function in the Kerberos v4 compatibility administration daemon (kadmind4) in MIT Kerberos 5 and in KTH Kerberos 4 and 5 improperly verifies the length field of a request, allowing remote attackers to execute arbitrary code via a buffer overflow attack.
The Web-Based Enterprise Management (WBEM) packages in Solaris 8 Update 1/01 or later install files with world or group write permissions, allowing local users to gain root privileges or cause a denial of service.
PAM 0.76 treats a disabled password as if it were an empty (null) password, allowing local and remote attackers to gain privileges as disabled users.
Multiple buffer overflows in Heimdal before version 0.5, possibly in both (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.
A vulnerability in the WebBrowser control used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via a script that accesses the Document property, bypassing <frame> and <iframe> domain restrictions.
Avaya Cajun switches P880, P882, P580, and P550R version 5.2.14 and earlier contain undocumented accounts (1) manuf and (2) diag with default passwords, allowing remote attackers to gain privileges.
Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.
Unknown vulnerability in routed for HP Tru64 UNIX from V4.0F to V5.1A allows local and remote attackers to read arbitrary files.
Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier allow remote attackers to execute arbitrary code via certain packets sent to UDP port 694.
Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, allowing remote attackers to execute arbitrary SQL via a SQL injection attack.
Balabit Syslog-NG versions 1.4.x before 1.4.15 and 1.5.x before 1.5.20 improperly track the size of a buffer during macro expansion, which may lead to denial of service and potentially allow remote attackers to execute arbitrary code.
Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long 'From' address, triggering the overflow when the user views or previews the message.
The dvips converter for Postscript files in the tetex package calls the system() function insecurely, allowing remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote attackers to cause a denial of service (reset) via a long HTTP request.
Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbound message.
In Bugzilla 2.14.x before 2.14.4 and 2.16.x before 2.16.1, the editproducts.cgi script, when the 'usebuggroups' feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, granting extra permissions to users.
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, MSDE 1.0, and MSDE 2000 can be executed by PUBLIC, allowing an attacker to gain privileges by updating a webtask owned by the database owner.
The bugzilla_email_append.pl script in Bugzilla versions 2.14.x before 2.14.4 and 2.16.x before 2.16.1 has a vulnerability that allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.
Cisco Unity versions 2.x and 3.x use well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.