CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to 'cause negative totals' via an order with a large quantity.
WWW File Share Pro version 2.42 and earlier allows remote attackers to bypass directory access restrictions via a URL with a trailing dot or a URI with a leading slash or backslash character.
Unknown vulnerability in the eflags checking in the 32-bit ptrace emulation for the Linux kernel on AMD64 systems allows local users to gain privileges.
The libCheckSignature function in crypto-utils.lib for OpenCA 0.9.1.6 and earlier only compares the serial numbers of certificates, which can lead to incorrect acceptance of signatures if the certificate chain is trusted by OpenCA.
Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code via a long Subject line.
Buffer overflow in DameWare Mini Remote Control before version 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.
Buffer overflow in a component of Microsoft Data Access Components (MDAC) versions 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.
Multiple vulnerabilities in the H.323 protocol implementation for Cisco IOS versions 11.3T through 12.2T allow remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in versions 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.
The SPP_VerifyPVV function in nCipher payShield SPP library versions 1.3.12, 1.5.18, and 1.6.18 returns a Status_OK value even if the HSM returns a different status code. This could lead applications to make incorrect security-critical decisions, such as accepting an invalid PIN number.
The CVE-2004-0068 vulnerability in PhpDig 1.6.5 and earlier allows remote attackers to execute arbitrary PHP code by modifying the $relative_script_path parameter to reference a URL on a remote web server containing the code.
The PHP remote file inclusion vulnerability in EasyDynamicPages 2.0 allows remote attackers to execute arbitrary PHP code by modifying the edp_relative_path parameter to reference a malicious serverdata.php script on a remote web server.
tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets.
Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic.
CVE-2004-0069 describes a format string vulnerability in HD Soft Windows FTP Server version 1.6 and earlier, allowing remote attackers to execute arbitrary code via format string specifiers in the username, processed by the wscanf function.
The vulnerability in module.php for ezContents allows remote attackers to execute arbitrary PHP code by modifying the link parameter to reference a URL on a remote web server that contains the code.
Multiple vulnerabilities in the H.323 protocol implementation for Nortel Networks Business Communications Manager, Succession 1000 IP Trunk and IP Peer Networking, and 802.11 Wireless IP Gateway allow remote attackers to cause a denial of service and possibly execute arbitrary code.
The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries.
An unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
The vulnerability in Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses. A remote attacker can bypass authentication by connecting from the same IP address as an active authenticated user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS