CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The bsguest.cgi guestbook script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.
Buffer overflow in 1st Up Mail Server 4.1 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long MAIL FROM command.
The mod_sqlpw module in ProFTPD does not reset a cached password when a user changes accounts using the 'user' command, allowing authenticated attackers to gain privileges of other users.
The simplestguest.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the guestbook parameter.
The ad.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
A one-byte buffer overflow in the replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.
Buffer overflow in oops WWW proxy server version 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or domain name obtained from a reverse DNS lookup.
CVE-2001-0060 describes a format string vulnerability in stunnel 3.8 and earlier that allows attackers to execute arbitrary commands via a malformed ident username.
In FreeBSD and possibly other operating systems, procfs does not properly restrict access to per-process mem and ctl files. This allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's address space.
The GTK+ library allows local users to specify arbitrary modules via the GTK_MODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program.
Buffer overflow in Kermit communications software in HP-UX 11.0 and earlier allows local users to cause a denial of service and possibly execute arbitrary commands.
The vulnerability in register.cgi in Ikonboard 2.1.7b and earlier allows remote attackers to execute arbitrary commands via the SEND_MAIL parameter, which overwrites an internal program variable that references a program to be executed.
Check Point VPN-1/FireWall-1 version 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets.
The 'Multiple Users' Control Panel in Mac OS 9 allows Normal users to gain Owner privileges by removing the Users & Groups Data File, effectively removing the Owner password.
MDaemon Pro version 3.5.1 and earlier allows local users to bypass the 'lock server' security setting by pressing the Cancel button at the password prompt, then pressing the enter key.
A backdoor account in the Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures.
The everythingform.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.
Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect the behavior of telnetd.
Vulnerability in fetchmail 5.5.0-2 and earlier related to the AUTHENTICATE GSSAPI command.
Buffer overflow in Bea WebLogic Server before version 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a '..' string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS