CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The HTML Help facility in Microsoft Windows 98, 98 SE, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder. This allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file.
CVE-2002-0709 describes SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter that allow remote attackers to execute arbitrary SQL queries via the RunReport option to SimpleBar.dll, and possibly other DLLs.
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.
Wordtrans version 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to execute arbitrary code or conduct cross-site scripting attacks via certain parameters (possibly 'dict') to the wordtrans.php script.
Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, allowing remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.
SquirrelMail versions 1.2.7 and earlier have cross-site scripting vulnerabilities that allow remote attackers to execute scripts as other web users. Attacks can be conducted via addressbook.php, options.php, search.php, or help.php.
Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems and Oracle 8 on VM allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.
The default Access Control Lists (ACLs) of the administration database for ZMerge 4.x and 5.x provide arbitrary users (including anonymous users) with Manager level access, allowing them to read or modify import/export scripts.
Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe.
MyHelpDesk 20020509 and possibly other versions have cross-site scripting vulnerabilities that allow remote attackers to execute scripts as other users. The attack can be carried out through parameters such as Title or Description when a new ticket is created by a support assistant.
Buffer overflow in the inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.
The config_inc2.php file in Mantis before version 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via specified parameters and cookies.
Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allow remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
Cross-site scripting vulnerability in DeepMetrix LiveStats versions 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via unfiltered (1) user-agent or (2) referrer data.
Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.2 allows restricted administrators to access certificate passwords stored in plaintext in the HTML source code for Certificate Management pages.
Buffer overflow in read_smtp_response of protocol.c in libesmtp before version 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via a certain response or (2) cause a denial of service via long server responses.
Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities.
Datalex PLC BookIt! Consumer before 2.2 stores usernames and passwords in plaintext in a cookie, which could allow remote attackers to gain privileges via Cross-site scripting or sniffing attacks.
The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configuration via direct requests to CHL files.
The PHPWiki Postnuke wiki module has a cross-site scripting vulnerability that allows remote attackers to execute scripts as other PHPWiki users via the pagename parameter.