CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer signedness error in rfc2231_get_param from PINE before version 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.
Aspppls for Solaris 8 allows local users to overwrite arbitrary files via a symlink attack on the .asppp.fifo temporary file.
The C-Media PCI sound driver in Linux before version 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities.
A vulnerability in GSAPAK.EXE for GameSpy Arcade, possibly in versions before 1.3e, allows remote attackers to overwrite arbitrary files and execute arbitrary code via .. (dot dot) sequences in filenames in a .APK (Zip) file.
Buffer overflow in Netris 0.52 and earlier, and possibly other versions, allows remote malicious Netris servers to execute arbitrary code on netris clients via a long server response.
CVE-2003-0575 involves a heap-based buffer overflow in the name services daemon (nsd) in SGI IRIX 6.5.x through 6.5.21f, allowing attackers to gain root privileges via the AUTH_UNIX gid list.
CVE-2003-0616 describes a format string vulnerability in the ePO service for McAfee ePolicy Orchestrator versions 2.0, 2.5, and 2.5.1. It allows remote attackers to execute arbitrary code via a POST request with format strings in the computerlist parameter, which are used when logging a failed name resolution.
The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
Novell iChain 2.2 before Support Pack 1 does not properly verify that URL redirects match the DNS name of an accelerator, allowing attackers to redirect URLs to malicious web sites.
Buffer overflow in WiTango Application Server and Tango 2000 allows remote attackers to execute arbitrary code via a long cookie to Witango_UserReference.
Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare version 0.9.16preRC and earlier, related to the VFS path being under the web document root.
CVE-2003-0671 describes a format string vulnerability in tcpflow that allows local users to execute arbitrary code via the device name argument in a setuid context.
Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.
Windows Media Player (WMP) 7 and 8, running on Internet Explorer and possibly other Microsoft products that process HTML, allows remote attackers to bypass zone restrictions and access or execute arbitrary files via an IFRAME tag pointing to an ASF file whose Content-location contains a File:// URL.
The default installation of MSDE via McAfee ePolicy Orchestrator versions 2.0 to 3.0 allows attackers to execute arbitrary code. This process involves obtaining the database administrator username and encrypted password from a configuration file, cracking the password due to weak cryptography, and using it to pass commands through xp_cmdshell.
Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with large length for a Text or Copyright string, or a large number of tracks, leading to a heap-based buffer overflow.
Multiple SQL injection vulnerabilities in the infolog module for phpgroupware 0.9.14 and earlier could allow remote attackers to conduct unauthorized database actions.
A vulnerability in rscsi in cdrtools 2.01 and earlier allows local users to overwrite arbitrary files and gain root privileges by specifying the target file as a command line argument, which is modified while rscsi is running with privileges.
Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail.
Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS