CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The admin.html file in StepWeb Search Engine (SWS) 2.5 stores passwords in links to manager.pl, allowing remote attackers with access to the admin.html file to gain administrative privileges to SWS.
The default configuration of the LPRng print spooler in Red Hat Linux 7.0 through 7.3 and Mandrake 8.1 and 8.2 accepts print jobs from arbitrary remote hosts.
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, allowing remote attackers to gain privileges and modify DAD settings.
The PL/SQL module in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.
Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process.
Multiple buffer overflows in Melange Chat server 2.02 allow remote or local attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments in the /yell command, long lines in the /etc/melange.conf configuration file, long file names, or possibly other attacks.
A vulnerability in the RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.
In FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, local users can access restricted files by closing file descriptors 0, 1, or 2. This may lead to unauthorized reading or writing of data by setuid processes.
Oracle9i database server version 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax.
The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone.
Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into fields during new customer registration.
Buffer overflow in sshd in OpenSSH versions 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication.
The webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.
Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.
IBM Informix Web DataBlade 4.12 improperly processes user input, allowing remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
Buffer overflows in the PL/SQL module in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code. The attack can be carried out through various long HTTP requests and long passwords.
Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet.
Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data.
The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer.
Integer overflow in sshd in OpenSSH versions 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication when OpenSSH is using SKEY or BSD_AUTH authentication.