CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root.
Buffer overflow in DNS resolver functions that perform lookup of network names and addresses occurs in BIND 4.9.8 and glibc 2.2.5 and earlier. This allows remote malicious DNS servers to execute arbitrary code.
Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7.0 or 2000 allows remote attackers to execute arbitrary code via a query that calls the OpenRowSet command.
Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function.
Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.
Buffer overflow in lsmcode in AIX 4.3.3 may lead to unauthorized access or execution of malicious code.
Vulnerability in template.dhcpo in AIX 4.3.3 related to an insecure linker argument.
Buffer overflow in pioout on AIX 4.3.3 may lead to unauthorized access or execution of malicious code.
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients.
CVE-2002-0735 describes a format string vulnerability in the logging() function in the C-Note Squid LDAP authentication module (squid_auth_LDAP) version 2.0.2 and earlier. This allows remote attackers to trigger log messages, potentially leading to denial of service and arbitrary code execution.
Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long 'bind DN' parameter.
PostCalendar 3.02 is vulnerable to cross-site scripting, allowing remote attackers to insert arbitrary HTML and scripts by modifying a calendar entry in its preview page.
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
The PHP administration script in popper_mod version 1.2.1 and earlier relies on Apache .htaccess authentication, allowing remote attackers to gain privileges if the script is not properly configured by the administrator.
SquirrelMail version 1.2.5 and earlier allows authenticated users to execute arbitrary commands by modifying the THEME variable in a cookie.
The csMailto.cgi program in CGIscript.net allows remote attackers to use it as a 'spam proxy', enabling them to send emails to arbitrary users via modified form-to, form-from, and form-results parameters.
Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command.
Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.