CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The xsoldier program allows local users to gain root access via a long argument.
Buffer overflow in L0pht AntiSniff allows remote attackers to execute arbitrary commands via a malformed DNS response packet.
Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.
Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges.
Buffer overflow in the krb_rd_req function in Kerberos 4 and 5 allows remote attackers to gain root privileges.
The calendar.pl and calendar_admin.pl scripts by Matt Kruse allow remote attackers to execute arbitrary commands via shell metacharacters.
The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, allowing the user to gain privileges by specifying an alternate program to execute.
Buffer overflow in the krb425_conv_principal function in Kerberos 5 allows remote attackers to gain root privileges.
CGI counter version 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters.
The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, allowing an attacker to download any type of file to a user's system by encoding it within an email message or news post.
The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, allowing them to modify user accounts or web pages.
The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers.
Buffer overflow in the Solaris netpr program allows local users to execute arbitrary commands via a long -p option.
The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker to recover it and use it to decrypt EFS data.
The Office 2000 UA ActiveX Control is marked as 'safe for scripting,' allowing remote attackers to conduct unauthorized activities via the 'Show Me' function in Office Help.
The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.
The vulnerability in ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by sending a request to the file with a large number of encoded spaces (%20) and ending with a .htr extension.
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the device's MAC address. This could allow remote attackers to gain root access.
Buffer overflow in the SMTP gateway for InterScan Virus Wall 3.32 and earlier allows a remote attacker to execute arbitrary commands via a long filename for a uuencoded attachment.
Buffer overflow in the Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS