CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the authentication process for the SMTP service in Microsoft Windows 2000 allows remote attackers to use incorrect credentials to gain privileges and conduct activities such as mail relaying.
Buffer overflow in dsh in dqs 3.2.7 in SuSE Linux 7.0 and earlier, and possibly other operating systems, allows local users to gain privileges via a long first command line argument.
Becky! version 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters.
The FTP server on Cisco Content Service 11000 series switches before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands.
The web management service on Cisco Content Service series 11000 switches before WebNS 4.01B29s or WebNS 4.10B17s allows a remote attacker to gain additional privileges by directly requesting the web management URL instead of navigating through the interface.
Minicom version 1.83.1 and earlier allows a local attacker to gain additional privileges via numerous format string attacks.
Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, allowing a local attacker to execute arbitrary macros with the user ID of the Word user.
HP Event Correlation Service (ecsd) included with OpenView Network Node Manager 6.1 allows a remote attacker to gain additional privileges via a buffer overflow attack in the '-restore_config' command line parameter.
The crontab in Vixie cron 3.0.1 and earlier does not properly drop privileges after a failed parsing of a modification operation, which could allow a local attacker to gain additional privileges when an editor is called to correct the error.
ScreamingMedia SITEWare versions 2.5 through 3.1 allow a remote attacker to read world-readable files via a .. (dot dot) attack through (1) the SITEWare Editor's Desktop or (2) the template parameter in SWEditServlet.
Buffer overflow in the BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
The ActiveX control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML email message or web page.
Oracle E-Business Suite Release 11i Applications Desktop Integrator (ADI) version 7.x includes a debug version of FNDPUB11I.DLL, which logs the APPS schema password in cleartext in a debug file. This allows local users to obtain the password and gain privileges.
eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, allowing a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS.
eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs.
CVE-2001-0522 describes a format string vulnerability in Gnu Privacy Guard (GnuPG or gpg) version 1.05 and earlier that can allow an attacker to gain privileges via format strings in the original filename stored in an encrypted file.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document.
Aladdin eSafe Gateway versions 3.0 and earlier allow a remote attacker to circumvent filtering of SCRIPT tags by embedding scripts within certain HTML tags, such as onload in the BODY tag, href in the A tag, BUTTON tag, INPUT tag, or any other tag where scripts can be defined.
Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command.
book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the 'current' parameter.