CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netscape (iPlanet) Certificate Management System version 4.2 and Directory Server version 4.12 store the administrative password in plaintext. This could allow local and possibly remote attackers to gain administrative privileges on the server.
Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges.
Buffer overflow in the host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query.
eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet, allowing remote attackers to upload files and execute arbitrary commands.
The Alabanza Control Panel does not require passwords to access administrative commands, allowing remote attackers to modify domain name information via the nsManager.cgi CGI program.
Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users.
Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.
A vulnerability in Element InstantShop allows remote attackers to modify price information via the 'price' hidden form variable in add_2_basket.asp.
The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an 'xhost +' command, allowing remote attackers to monitor X Windows events and gain privileges.
Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.
CVE-2000-1044 describes a format string vulnerability in ypbind-mt in SuSE 6.2 and possibly other Linux operating systems, allowing an attacker to gain root privileges.
Buffer overflow in SMTP service of Lotus Domino 5.0.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long ENVID keyword in the 'MAIL FROM' command.
CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication if the LDAP server allows null passwords.
Format string vulnerabilities in the ssh program in OpenBSD (and possibly other BSD-based operating systems) allow attackers to gain root privileges.
In Red Hat Linux 6.2, there is a vulnerability that relies on the pathname specified by the RSH environmental variable. This allows local users to gain root privileges by modifying the RSH variable to point to a Trojan horse program.
CVE-2000-1010 describes a format string vulnerability in talkd in OpenBSD and possibly other BSD-based operating systems, allowing remote attackers to execute arbitrary commands via a user name containing format characters.
Buffer overflow in the catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.
Multiple buffer overflows in LBNL tcpdump allow remote attackers to execute arbitrary commands.
AIX sysback before 4.2.1.13 uses a relative path to find and execute the hostname program, allowing local users to gain privileges by modifying the path to point to a malicious hostname program.
quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request.