CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in Thomas Hauck's Jana Server versions 2.x through 2.2.1 and 1.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code.
The login form for LogiSense software, including Hawk-i Billing, Hawk-i ASP, and DNS Manager, has an SQL injection vulnerability that allows remote attackers to bypass authentication by injecting SQL code into the password field.
Buffer overflow in Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Subject field.
CVE-2002-1027 describes a vulnerability in the default HTTP 500 error script (500error.jsp) for Macromedia Sitespring 1.2.0, allowing remote attackers to execute arbitrary web scripts. Attackers can achieve this by linking to 500error.jsp with the script in the et parameter.
Cisco IOS versions 12.0 through 12.2, when supporting SSH, is vulnerable to an attack that can lead to denial of service through CPU consumption. An attacker can send a large packet designed to exploit the SSH CRC32 attack detection overflow.
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier allows remote attackers to execute arbitrary code via a long database name parameter.
Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.
HP JetDirect printers allow remote attackers to obtain the administrative password for the (1) web and (2) telnet services via an SNMP request to the variable (.iso.3.6.1.4.1.11.2.3.9.4.2.1.3.9.1.1.0.
none.php for SunPS iRunbook 2.5.2 allows remote attackers to read arbitrary files via an absolute pathname in the argument.
Buffer overflow in the PGP public key server before version 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long search argument.
Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.
Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.
CGIScript.net csNews.cgi allows remote authenticated users to execute arbitrary Perl code via terminating quotes and metacharacters in text fields of the 'Advanced Settings' capability.
CVE-2002-1007 describes cross-site scripting vulnerabilities in Blackboard 5 that allow remote attackers to execute arbitrary web scripts. The attack can be carried out by manipulating parameters in various scripts, such as login.pl, ProcessInfo.cgi, and index.cgi.
The 'View Bugs' page (view_all_bug_page.php) in Mantis 0.17.4a and earlier displays summaries of private bugs for users who do not have access to any projects.
LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the '/./' directory.
The FTP service in Watchguard Soho Firewall 5.0.35a allows remote attackers to gain privileges with a correct password but an incorrect user name.
Multiple cross-site scripting vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to execute arbitrary script as other CBMS users.
modsecurity.php version 1.10 and earlier, in phpWebSite version 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_prefix parameter that points to the malicious code.
Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.