CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Apple iChat AV 2.1, AV 2.0, and 1.0.1 allows remote attackers to execute arbitrary programs via a specially crafted link.
A format string vulnerability in the Speedtouch USB driver before version 1.3.1 allows local users to execute arbitrary code via modem_run, pppoa2, or pppoa3.
Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the attrib_valid function, covert function, declare statement, crafted query plan, or crafted install java statement (requires database owner or 'sa' role privileges).
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
Buffer overflow in htget 0.93 allows remote attackers to execute arbitrary code via a crafted URL.
Untrusted execution path vulnerability in the diag commands (lsmcode, diag_exec, invscout, invscoutd) in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.
Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.
Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.
The vulnerability in Asante FM2008 running firmware 1.06 stores the username and password in cleartext in the configuration backup, which could allow remote attackers to gain unauthorized access.
The vulnerability in Cisco Unity versions 2.x, 3.x, and 4.x integrated with Microsoft Exchange is due to hard-coded usernames and passwords. A remote attacker can exploit these credentials to gain unauthorized access and change configuration settings or read incoming and outgoing email messages.
The Asante FM2008 device running firmware version 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access.
Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifying the id parameter to reference a URL on a remote web server that contains the code.
Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.
Vulnerability in FreeS/WAN 1.x and 2.x and related products (superfreeswan 1.x, openswan before 1.0.6 and 2.1.4, strongSwan before 2.1.3) allows remote attackers to authenticate using spoofed PKCS#7 certificates. A self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.
Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file.
Vulnerability in osTicket allows remote attackers to view sensitive uploaded files and potentially execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
An unknown vulnerability in the 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication through repeated login attempts using any username and password.
A vulnerability in the Unreal Engine allows remote attackers to execute arbitrary code by sending a UDP packet with a long value in a secure query, causing memory overwrite. It affects multiple games including Unreal Tournament 2004, DeusEx, and Postal 2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS