CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to rawdocdata.asp or RawCustomSearchField.asp containing an embedded SQL statement.
The dupatch and setld utilities in HP Tru64 UNIX 5.1B PK1 and earlier allow local users to overwrite files and possibly gain root privileges via a symlink attack.
Kerio Personal Firewall (KPF) version 2.1.4 and earlier allows remote attackers to execute administrator commands by sniffing packets from a valid session and replaying them against the remote administration server.
Buffer overflow in PostMethod() function for Monkey HTTP Daemon (monkeyd) 0.6.1 and earlier allows remote attackers to execute arbitrary code via a POST request with a large body.
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in Content-type and Content-encoding fields.
SQL injection vulnerability in bttlxeForum 2.0 beta 3 and earlier allows remote attackers to bypass authentication via the (1) username and (2) password fields, and possibly other fields.
A buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.
The gkrellm-newsticker plugin before version 0.3-3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI.
Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary code via a certain request to the HTTP receiver.
The plugin.ocx for Internet Explorer 5.01, 5.5, and 6.0 contains a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via the Load() method.
The handleAccept function in rinetd before version 0.62 does not properly resize the connection list when it becomes full, leading to incorrect array index settings. This allows remote attackers to cause denial of service and potentially execute arbitrary code via a large number of connections.
A stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a 'CREATE DATABASE LINK' query containing a long USING parameter.
The LDAP name service in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could allow attackers to log in without a password.
The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet.
In MacOS X, DirectoryServices trusts the PATH environment variable to locate and execute the touch command, allowing local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.
Multiple buffer overflows in Samba before version 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service.
KDE 2 and KDE 3.1.1 and earlier 3.x versions allow attackers to execute arbitrary commands via PostScript (PS) or PDF files, due to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer.
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, leading to a heap-based buffer overflow.
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
The xfsdump program in version xfsdq does not securely create quota information files, allowing local users to gain root privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS