CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenSSL versions 0.9.6d and earlier, and 0.9.7-beta2 and earlier, do not properly handle ASCII representations of integers on 64-bit platforms. This could allow attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflows in OpenSSL versions 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via a large client master key in SSL2 or a large session ID in SSL3.
Buffer overflow in OpenSSL 0.9.7 before version 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key.
Check Point FireWall-1 SecuRemote/SecuClient versions 4.0 and 4.1 allow clients to bypass the 'authentication timeout' by modifying the to_expire or expire values in the client's users.C configuration file.
The VPN Server module in the Linksys EtherFast BEFVP41 Cable/DSL VPN Router before version 1.40.1 reduces the key lengths for manually entered keys, making it easier for attackers to crack them.
Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname obtained through a reverse DNS lookup.
Buffer overflow in SH39 MailServer 1.21 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long command to the SMTP port.
KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems do not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
A cross-site scripting vulnerability in ReBB allows remote attackers to execute arbitrary Javascript and steal cookies via an IMG tag whose URL includes the malicious script.
CVE-2002-0412 describes a vulnerability in the TraceEvent function in ntop before version 2.1 that allows remote attackers to execute arbitrary code by injecting format strings into calls to the syslog function. This can be done via an HTTP GET request, a username in HTTP authentication, or a password in HTTP authentication.
AeroMail versions before 1.45 have a cross-site scripting vulnerability in message.php, allowing remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.
The vulnerability in simpleinit on Linux systems is that it does not close a FIFO file descriptor before creating a child process. This allows the child process to execute arbitrary programs with root privileges.
OpenBSD versions 2.9 through 3.1 allow local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.
Integer overflow in the xdr_array function in RPC servers for operating systems using libc, glibc, or other code based on SunRPC, including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.
The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic (VBA) scripts within a mail merge document that is saved in HTML format.
Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
Bugzilla 2.14 before 2.14.2 and 2.16 before 2.16rc2 have cross-site scripting vulnerabilities. Attackers can exploit the full name field to execute scripts in the context of other Bugzilla users.
Standalone Macromedia Flash Player 5.0 before version 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the 'exec' FSCommand.
ISS RealSecure for Nokia devices before IPSO build 6.0.2001.141d allows user 'skank' on machine 'starscream' to become a key manager when the 'first time connection' feature is enabled and before any legitimate administrators have connected.