CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.
Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root.
Vulnerability in the administration server for HP VirtualVault 4.5 on HP-UX 11.04 allows remote web servers or privileged external processes to bypass access restrictions and establish connections to the server.
Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to plugin.php, admin.php, or del.php that modifies the PHORUM[settings_dir] variable to point to a directory containing a PHP file with the commands.
In OpenSSH 3.2.2, when using YP with netgroups, there is a possibility that users may successfully authenticate and log in with another user's password under certain conditions.
Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.
The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic (VBA) scripts within a mail merge document that is saved in HTML format.
EMU Webmail allows local users to execute arbitrary programs via a .. (dot dot) in the HTTP Host header that points to a Trojan horse configuration file.
Watchguard SOHO firewall version 5.0.35 unpredictably disables certain IP restrictions for customized services set before the administrator upgrades to 5.0.35.
CVE-2002-0525 describes format string vulnerabilities in inews and rnews for INN 2.2.3 and earlier. This allows local users and malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.
Cross-site scripting vulnerability in functions-inc.asp for ASP-Nuke RC1 allows remote attackers to execute script as other ASP-Nuke users by embedding it within an IMG tag.
The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record. This could make it easier for remote attackers to bypass applications that restrict access based on host names.
CVE-2002-0504 is a cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier, where the lack of proper quoting of results from the getLastError method allows remote attackers to execute scripts in other clients via the NFuse_Application parameter in launch.jsp or launch.asp.
Cross-site scripting vulnerability in WebSight Directory System 0.1 allows remote attackers to execute arbitrary Javascript and gain access to the WebSight administrator via a new link submission containing the script in a website name.
The admin.php file in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, allowing remote attackers to bypass authentication and gain privileges by setting the admin cookie to an arbitrary value.
Instant Web Mail versions before 0.60 do not properly filter CR/LF sequences, allowing remote attackers to execute arbitrary POP commands via the id parameter in message.php or modify certain mail message headers via various parameters in write.php.
The traceroute.pl CGI script version 1.0 for Linux Directory Penguin allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter.
Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434.