CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The pam_ldap authentication module in Solaris 8 allows remote attackers to bypass authentication by using a NULL password.
Buffer overflow in the pi program in PlanetIntra 2.5 allows remote attackers to execute arbitrary commands.
mailnews.cgi version 1.3 and earlier allows remote attackers to execute arbitrary commands via a user name that contains shell metacharacters.
Chili!Soft ASP for Linux before 3.6 does not properly set group privileges when running in inherited mode, which could allow attackers to gain privileges via malicious scripts.
Buffer overflow in Analog before version 4.16 allows remote attackers to execute arbitrary commands by using the ALIAS command to construct large strings.
In PHP-Nuke 4.4, the files bb_smilies.php and bbcode_ref.php allow remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. (dot dot) sequences into a malformed username argument.
UploadServlet in Bajie HTTP JServer 0.78, and possibly other versions before 0.80, allows remote attackers to execute arbitrary commands by uploading a program and then accessing the created file.
Oracle Java Virtual Machine (JVM) for version 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.
Buffer overflow in QNX RTP 5.60 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large number of arguments to the stat command.
Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records.
Buffer overflow in the vCard handler in Outlook 2000 and 98, and Outlook Express 5.x allows an attacker to execute arbitrary commands via a malformed vCard birthday field.
The orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the report capability.
The HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly.
Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges.
Buffer overflow in MERCUR SMTP server 3.30 allows remote attackers to execute arbitrary commands via a long EXPN command.
Buffer overflow in the snmpXdmid daemon in Solaris allows remote attackers to execute arbitrary commands via a long 'indication' event.
CVE-2001-0281 describes a vulnerability in the DbgPrint function, used in debug messages for some Windows NT drivers. This may allow local users to gain elevated privileges.
Buffer overflow in the IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header (AH) IPv4 option.
Buffer overflow in post-query sample CGI program allows remote attackers to execute arbitrary commands via an HTTP POST request that contains at least 10001 parameters.
Buffer overflow in the VB-TSQL debugger object (vbsdicli.exe) in Visual Studio 6.0 Enterprise Edition allows remote attackers to execute arbitrary commands.