CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability was incomplete, allowing remote attackers to gain additional privileges by directly requesting the web management URL.
Buffer overflow in HP Tru64 UNIX versions 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows attackers to execute arbitrary code via a long _XKB_CHARSET environment variable in (1) dxpause, (2) dxconsole, or (3) dtsession.
Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable. This affects components such as csh, dtsession, dxsysinfo, imapd, inc, uucp, uux, rdist, and deliver.
Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter.
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.
The ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file.
Cross-site scripting vulnerabilities in the iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute scripts as the administrator via modified LOCID or OC parameters in administrator URLs.
The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, making it easier for remote attackers to conduct brute force password guessing.
Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.
The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripts within an Excel workbook that contains an XSL stylesheet.
Gravity Storm Service Pack Manager 2000 creates a hidden share (SPM2000c$) mapped to the C drive, which may allow local users to bypass access restrictions on certain directories in the C drive, such as system32, by accessing them through the hidden share.
PHPNetToolpack 0.1 relies on its environment's PATH to find and execute the traceroute program, which could allow local users to gain privileges by inserting a Trojan horse program into the search path.
CVE-2002-0501 describes a format string vulnerability in the log_print() function of the Posadis DNS server before version m5pre2, allowing local users and possibly remote attackers to execute arbitrary code via format strings inserted into logging messages.
Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2 may be vulnerable to a SQL injection attack, allowing remote attackers to cause a denial of service or execute certain queries via manipulation of the sort order parameter in buglist.cgi.
Webmin 0.96 and Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication. Attackers can gain privileges by using certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.
Buffer overflow in the X11 library (libX11) on Caldera Open UNIX 8.0.0 and UnixWare 7.1.1, and possibly other operating systems, allows local users to gain root privileges via a long -xrm argument to programs such as dtterm or xterm.
The authoring function in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content by modifying the upload location.
imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as ftp, owwwPath, and oftpPath.
Buffer overflow in libpng 1.0.12-3.woody.2 and libpng3 1.2.1-1.1.woody.2 on Debian GNU/Linux 3.0 and other operating systems may allow attackers to cause a denial of service and possibly execute arbitrary code.