CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Winamp client allows remote attackers to execute commands via a long entry in a .pls file.
The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.
The userhelper program in the usermode package of Red Hat allows local users to gain root access via a .. (dot dot) attack.
Hotmail does not properly filter JavaScript code from a user's mailbox, allowing a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag.
The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command.
The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands.
The invoke.cfm template in Allaire Spectra 1.0 allows users to bypass authentication via the bAuthenticated parameter.
Buffer overflow in the setlocale function in the libc module of FreeBSD allows attackers to execute arbitrary code via a long PATH_LOCALE environment variable.
The Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, allowing remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets sent to UDP port 2048.
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, known as the Excel 'CALL Vulnerability.'
Vulnerability in Cisco IOS versions 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface.
The automatic download option in the ncftp 2.4.2 FTP client on Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files to be downloaded.
Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges.
Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess.
Unspecified vulnerability in crontab in IBM AIX 3.2 allows local users to gain root privileges via unknown attack vectors.
Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, allowing remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data.
Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request.
The loadmodule function in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, allowing local users to gain privileges.
The HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host.
SAS System 5.18 on VAX/VMS has insecure permissions for its directories and startup file, allowing local users to gain elevated privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS