CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to execute arbitrary script as other CBMS users.
Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.
Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.
Buffer overflow in Jabber plug-in for Gaim client before version 0.58 allows remote attackers to execute arbitrary code.
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier allows remote attackers to execute arbitrary code via a long database name parameter.
The 'View Bugs' page (view_all_bug_page.php) in Mantis 0.17.4a and earlier displays summaries of private bugs for users who do not have access to any projects.
none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via an absolute pathname in the argument.
Buffer overflow in the PGP public key server before version 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long search argument.
Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.
CVE-2002-1007 describes cross-site scripting vulnerabilities in Blackboard 5 that allow remote attackers to execute arbitrary web scripts. The attack can be carried out by manipulating parameters in various scripts, such as login.pl, ProcessInfo.cgi, and index.cgi.
The FTP service in Watchguard Soho Firewall 5.0.35a allows remote attackers to gain privileges with a correct password but an incorrect user name.
modsecurity.php version 1.10 and earlier, in phpWebSite version 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_prefix parameter that points to the malicious code.
Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.
SquirrelMail versions 1.2.7 and earlier have cross-site scripting vulnerabilities that allow remote attackers to execute scripts as other web users. Attacks can be conducted via addressbook.php, options.php, search.php, or help.php.
Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, allowing remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.
Wordtrans version 1.1pre8 and earlier in the wordtrans-web package allows remote attackers to execute arbitrary code or conduct cross-site scripting attacks via certain parameters (possibly 'dict') to the wordtrans.php script.
Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.
Multiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.
CVE-2002-0916 describes a format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, distributed in Squid 2.4.STABLE6 and earlier. This allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.
Buffer overflow in the inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.