CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack.
Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an [img] tag with a closing quote followed by the script.
The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, making it easier for an attacker to decrypt the passwords using brute force techniques.
In globals.php in PHP Address before version 0.2f, with the allow_url_fopen and register_globals variables enabled, remote attackers can execute arbitrary PHP code via a URL in the LangCookie parameter.
Multiple buffer overflows in Novell NetMail (NIMS) 3.0.3 before version 3.0.3C allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) WebAdmin or (2) ModWeb.
SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--" sequence in the username and password.
The Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP port 9833, which generates a reply that includes the router's password and other sensitive information in cleartext.
Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, allowing remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.
The CGI program MakeBook 2.2 in Scripts For Educators allows remote attackers to execute scripts as other visitors or execute server-side includes (SSI) as the web server via improperly filtered parameters (1) Name or (2) Email.
Wordtrans version 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to execute arbitrary code or conduct cross-site scripting attacks via certain parameters (possibly 'dict') to the wordtrans.php script.
Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Cross-site scripting vulnerability in DeepMetrix LiveStats versions 5.03 through 6.2.1 allows remote attackers to execute arbitrary script as the LiveStats user via unfiltered (1) user-agent or (2) referrer data.
Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the extended stored procedures.
Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe.
CVE-2002-0925 describes a format string vulnerability in the mmsyslog function that allows remote attackers to execute arbitrary code. This vulnerability affects mmmail version 0.0.13 and earlier, as well as mmftpd version 0.0.7 and earlier.
CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote authenticated users to download the file and crack the passwords of other users.
CVE-2002-0916 describes a format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, distributed in Squid 2.4.STABLE6 and earlier. This allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.
Buffer overflows in the netstd 3.07-17 package allow remote DNS servers to execute arbitrary code via a long FQDN reply. This issue has been observed in utilities such as linux-ftpd, pcnfsd, tftp, traceroute, and from/to.
Multiple buffer overflows in mnews 1.22 and earlier allow a remote NNTP server to execute arbitrary code or local users to gain privileges via long command line arguments or environment variables.
Buffer overflow in Sendmail before version 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server.