CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Sun AnswerBook2 versions 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.
service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long service argument.
Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain privileges.
The codeparse.php in Open Bulletin Board (OpenBB) 1.0.0 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts and steal cookies via JavaScript in the IMG tag.
The XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
The smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs. This allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process.
Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-*.reg file which contains the administrator name and password in cleartext.
Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allow remote attackers to execute arbitrary code via (1) a long DNS hostname determined using reverse DNS lookups, (2) a long AUTH string, or (3) certain data in the xtell request.
Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.
Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a LIST command containing a large number of /, *, and .. characters.
Windows Media Player version 8.00.00.4477, and possibly other versions, automatically detects and executes .wmf files and other content, even when the file's extension or content type does not specify .wmf. This could make it easier for attackers to conduct unauthorized activities via Trojan horse files containing .wmf content.
The cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary scripts as other Cobalt users via JavaScript in a URL to (1) service.cgi or (2) alert.cgi.
The HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 is vulnerable to an attack that can lead to denial of service. Remote attackers can perform a port scan of the management IP address, resulting in the telnet service being disabled.
Buffer overflows in CFS daemon (cfsd) before 1.3.3-8.1, and 1.4x before 1.4.1-5, allow remote attackers to cause a denial of service and possibly execute arbitrary code.
Buffer overflow in University of Washington imap server (uw-imapd) in versions imap-2001 and imap-2001a, as well as earlier versions, allows remote authenticated users to execute arbitrary code via a long BODY request.
Buffer overflow in Essentia Web Server 2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL.
Fasttrack p2p, used in applications such as KaZaA, grokster, and morpheus, allows remote attackers to spoof other users by modifying the username and network information in the message header.
CVE-2002-0316 describes a cross-site scripting vulnerability in eXtreme message board (XMB) version 1.6x and earlier. It allows remote attackers to execute scripts as other XMB users by inserting the script into an IMG tag.
The Gator ActiveX component (IEGator.dll) version 3.0.6.1 allows remote websites to install arbitrary software by specifying a Trojan Gator installation file (setup.ex_) in the src parameter.
CVE-2002-0319 is a cross-site scripting vulnerability in edituser.php for pforum version 1.14 and earlier, allowing remote attackers to execute scripts and steal cookies from other users via JavaScript in a username.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS