CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable.
Buffer overflow in ipcs in Solaris 7 x86 allows local users to execute arbitrary code via a long TZ (timezone) environmental variable.
Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.
ip_conntrack_ftp in the IPTables firewall for Linux 2.4 allows remote attackers to bypass access restrictions for an FTP server via a PORT command that lists an arbitrary IP address and port number, which is added to the RELATED table and allowed by the firewall.
Microsoft Data Access Component Internet Publishing Provider version 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests.
Buffer overflow in logging functions of licq before version 1.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary commands.
Buffer overflow in dtsession on Solaris, and possibly other operating systems, allows local users to gain privileges via a long LANG environmental variable.
Licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Cross-site scripting (XSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script.
In SquirrelMail version 1.0.4 and earlier, the load_prefs.php file and supporting files do not properly initialize certain PHP variables. This allows remote attackers to view sensitive files and execute arbitrary code by uploading a message that could be interpreted as PHP.
Transsoft Broker version 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL.
ArGoSoft FTP Server version 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a '.lnk.' extension, which bypasses WFTPD's check for a '.lnk' extension.
PHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to the mail() function, allowing local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Buffer overflow in the Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request passed to the extension through IIS 5.0.
The time server daemon 'timed' allows remote attackers to cause a denial of service by sending malformed packets.
Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the '.ASX Buffer Overrun' vulnerability.
Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter.
Buffer overflows in ascdc Afterstep allow local users to gain root privileges when running with setuid. This issue can be exploited via long -d, -m, or -f options.