CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges.
service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long service argument.
Buffer overflow in Sun AnswerBook2 versions 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.
Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program.
The codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts and steal cookies via JavaScript in the IMG tag.
The XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
XChat versions 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allow remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING.
Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP GET request to the /reports/ directory.
FileSeek.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) head or (2) foot parameters.
Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long '220' banner.
Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 allows remote attackers to execute arbitrary code via a long movie parameter.
WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password.
AOL Instant Messenger (AIM) allows remote attackers to steal files that are being transferred to other clients by connecting to port 4443 (Direct Connection) or port 5190 (file transfer) before the intended user.
Version 3.3.03 and earlier of Snitz Forums 2000 contains a SQL injection vulnerability in members.asp, allowing remote attackers to execute arbitrary code.
dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user_logged_in or user_dnstools_administrator parameters.
Buffer overflow in the X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.
PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch_info.php with the newpass and confirm parameters both set to the new password.
Buffer overflow in the Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote attackers to cause a denial of service or execute arbitrary code via the Error or Notice parameters.
Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long channel name in an IRC URI.
CVE-2002-0598 describes a format string vulnerability in Foundstone FScan 1.12 that allows remote attackers to execute arbitrary code on the scanning system via format string specifiers in the server banner.