CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Matrix CGI vault Last Lines 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the $error_log variable.
Buffer overflows in DayDream BBS versions 2.9 through 2.13 may allow remote attackers to execute arbitrary code via specific control codes.
Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via other vulnerabilities.
DeleGate versions 7.7.0 and 7.7.1 have a cross-site scripting vulnerability. The issue is that scripting commands are not properly quoted in the '403 Forbidden' error page, allowing remote attackers to execute arbitrary Javascript on other clients.
CVE-2001-1203 describes a format string vulnerability in gpm-root in gpm versions 1.17.8 through 1.17.18 that allows local users to gain root privileges.
Namazu versions 2.0.9 and earlier have a cross-site scripting vulnerability that allows remote attackers to execute arbitrary Javascript as other web users. The issue occurs in the error message returned when an invalid index file is specified in the idxname parameter.
The web administration server for ELSA Lancom 1100 Office does not require authentication, allowing remote attackers to gain administrative privileges by connecting to the server.
Namazu versions 2.0.8 and earlier have a cross-site scripting vulnerability that allows remote attackers to execute arbitrary Javascript in the context of other web users via the index file name displayed when showing hit numbers.
The get_input function in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL injection attack.
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, allowing local users to gain root privileges.
D-Link DWL-1000AP Firmware 3.2.28 #483 stores the administrative password in plaintext in the default Management Information Base (MIB), allowing remote attackers to gain administrative privileges.
The Cyrus SASL library has a format string vulnerability in the default logging callback function _sasl_syslog, which may allow remote attackers to execute arbitrary commands.
The uuxqt program in the Taylor UUCP package improperly removes dangerous long options, allowing local users to gain privileges by calling uux and specifying an alternate configuration file with the --config option.
Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
Directory traversal vulnerability in the HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request. This affects versions 2.0 through 2.6.18 and 2.6.19 through 3.0.10.
Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the system.
PFinger versions 0.7.5 through 0.7.7 have a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in a .plan file.
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.
Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions raiserror, formatmessage, or xp_sprintf.