CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.
Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.
Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges.
Buffer overflow in the host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query.
The Alabanza Control Panel does not require passwords to access administrative commands, allowing remote attackers to modify domain name information via the nsManager.cgi CGI program.
Netscape (iPlanet) Certificate Management System version 4.2 and Directory Server version 4.12 store the administrative password in plaintext. This could allow local and possibly remote attackers to gain administrative privileges on the server.
The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an 'xhost +' command, allowing remote attackers to monitor X Windows events and gain privileges.
A vulnerability in Element InstantShop allows remote attackers to modify price information via the 'price' hidden form variable in add_2_basket.asp.
Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users.
eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet, allowing remote attackers to upload files and execute arbitrary commands.
The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an 'xhost + localhost' command, allowing local users to sniff X Windows events and gain privileges.
The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.
Buffer overflow in the SHTML logging functionality of iPlanet Web Server 4.x allows remote attackers to execute arbitrary commands via a long filename with a .shtml extension.
Poll It 2.0 has a vulnerability in pollit.cgi that allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter.
A format string vulnerability in the top program allows local attackers to gain root privileges via the 'kill' or 'renice' function.
Format string vulnerability in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.
Buffer overflow in CSAdmin module in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large packet.
Buffer overflow in the catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.
CVE-2000-1010 describes a format string vulnerability in talkd in OpenBSD and possibly other BSD-based operating systems, allowing remote attackers to execute arbitrary commands via a user name containing format characters.
Format string vulnerabilities in the ssh program in OpenBSD (and possibly other BSD-based operating systems) allow attackers to gain root privileges.