CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in nsd on SGI IRIX before version 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file.
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields. These headers can cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message.
Microsoft Internet Explorer versions 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity.
A cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file.
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields. These headers can cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message.
Heap-based buffer overflow in the cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.
PowerFTP Personal FTP Server versions 2.03 through 2.10 stores sensitive account information in plaintext in the ftpserver.ini file, allowing attackers with access to the file to gain privileges.
Buffer overflow in the vpnclient program for UNIX VPN Client before version 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument.
Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors.
Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname.
Buffer overflow in sastcpd in SAS/Base 8.0 and 8.1 or in objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument.
Etype Eserv 2.97 allows remote attackers to redirect traffic to other sites via the PORT command.
The Safe Mode feature (safe_mode) in PHP from version 3.0 to 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using 'LOAD DATA INFILE LOCAL' SQL statements.
Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or RTF. This could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to.
A buffer overflow in GNU Chess (gnuchess) version 5.02 and earlier may occur when the application is used in a manner inconsistent with its design as a single-user application. This may allow local or remote attackers to execute arbitrary code via a long command.
Buffer overflow in admin.cgi for Nullsoft Shoutcast Server 1.8.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an argument with a large number of backslashes.
Buffer overflow in plDaniels ripMime 1.2.6 and earlier, used in other programs such as xamime and inflex, allows remote attackers to execute arbitrary code via an attachment with a long filename.
psyBNC 2.3 beta and earlier allows remote attackers to spoof encrypted, trusted messages by sending lines that begin with the '[B]' sequence, which makes the message appear legitimate.
Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments.
The mod_python module in version 2.7.6 and earlier allows access to a module indirectly imported by a published module, enabling remote attackers to call potentially dangerous functions from the imported module.