CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unknown vulnerability in Cisco ONS 15327 before version 4.1(3), ONS 15454 before version 4.6(1), ONS 15454 SD before version 4.1(3), and Cisco ONS15600 before version 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
Buffer overflow vulnerability in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including version 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
SQL injection vulnerability in login.asp in thePHOTOtool allows remote attackers to gain unauthorized access via the password field.
Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed (.RP, .RT, .RAM, .RPM, .SMIL) files.
The do_change_cipher_spec function in OpenSSL versions 0.9.6c to 0.9.6k and 0.9.7a to 0.9.7c allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
Multiple format string vulnerabilities in GNU Anubis versions 3.6.0 through 3.6.2 and 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to the info, anubis_error, and ssl_error functions.
An off-by-one buffer overflow in the _xlate_ascii_write() function in ProFTPD versions 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Buffer overflow in the UUDeview package, used in WinZip versions 6.2 through 8.1 SR-1, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
Buffer overflow in Serv-U ftp before version 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
The firmware of the Gigabyte Gn-B46B 2.4Ghz wireless broadband router version 1.003.00 allows local users on the same network to bypass authentication by using a copy of the router's HTML menu on a separate system.
Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request.
The American Power Conversion (APC) Web/SNMP Management SmartSlot Card versions 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access.
A stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before version 4.5.538.001 and ZoneLabs Integrity client before version 4.0.146.046 and 4.5 before version 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 version 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access. The attack can be executed through various parameters in PHP files, such as cat, id, and cat_manufacturer.
Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.
Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username.
Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS