CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco VPN 3000 Concentrator versions 2.2.x and 3.x before 3.5.2 allows restricted administrators to access certificate passwords stored in plaintext in the HTML source code for Certificate Management pages.
Buffer overflow in read_smtp_response of protocol.c in libesmtp before version 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via a certain response or (2) cause a denial of service via long server responses.
Multiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary and other capabilities.
Microsoft Visual FoxPro 6.0 does not register its associated files with Internet Explorer, allowing remote attackers to execute Visual FoxPro applications without warning via HTML that references specially-crafted filenames.
AnalogX Proxy versions before 4.12 are vulnerable to buffer overflows that allow remote attackers to cause a denial of service and potentially execute arbitrary code. The attack can be performed via a long HTTP request to TCP port 6588 or a long DNS hostname in a SOCKS 4A request to TCP port 1080.
Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the extended stored procedures.
Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long request to TCP port 8001.
SunPCi II VNC uses a weak authentication scheme, allowing remote attackers to obtain the VNC password by sniffing the random byte challenge used as the key for encrypted communications.
Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
The CGI program MakeBook 2.2 in Scripts For Educators allows remote attackers to execute scripts as other visitors or execute server-side includes (SSI) as the web server via improperly filtered parameters (1) Name or (2) Email.
The Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP port 9833, which generates a reply that includes the router's password and other sensitive information in cleartext.
SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--" sequence in the username and password.
Multiple buffer overflows in Novell NetMail (NIMS) 3.0.3 before version 3.0.3C allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) WebAdmin or (2) ModWeb.
In globals.php in PHP Address before version 0.2f, with the allow_url_fopen and register_globals variables enabled, remote attackers can execute arbitrary PHP code via a URL in the LangCookie parameter.
The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, making it easier for an attacker to decrypt the passwords using brute force techniques.
Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an [img] tag with a closing quote followed by the script.
GeekLog versions 1.3.5 and earlier have cross-site scripting vulnerabilities that allow remote attackers to execute arbitrary scripts. Attacks can be carried out via the url variable in the Link field of a calendar event, the topic parameter in index.php, or the title parameter in comment.php.
The Administration console for Abyss Web Server 1.0.3 before Patch 2 allows remote attackers to gain privileges and modify server configuration via direct requests to CHL files.
The PHPWiki Postnuke wiki module has a cross-site scripting vulnerability that allows remote attackers to execute scripts as other PHPWiki users via the pagename parameter.
Buffer overflow in Pegasus mail client 4.01 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) To or (2) From headers.