CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message.
Arkeia backup server version 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information.
Buffer overflows in Pileup before 1.2 allow local users to gain root privileges via (1) long command line arguments, or (2) a long callsign.
Cross-site scripting vulnerability in CGIWrap before version 3.7 allows remote attackers to execute arbitrary Javascript on other web clients. Attackers can inject Javascript into error messages generated by CGIWrap.
The SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier accepts arbitrary community strings with requested MIB modifications, allowing remote attackers to obtain sensitive information such as WEP keys.
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files.
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.
Buffer overflow in the Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.
Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone. Attackers can then use compiled HTML help (.chm) files to execute arbitrary programs.
Default ECL in Lotus Notes before version 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email.
The Horde Internet Messaging Program (IMP) before version 2.2.6 and 1.2.6 has a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript embedded in an email.
An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.
Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.
The prepend.php3 file in PHPLib before version 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server.
The telnet service in Microsoft Windows 2000 creates named pipes with predictable names and does not properly verify them, allowing local users to execute arbitrary commands.
The dnskeygen tool in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for an HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG). This allows attackers to obtain the keys and perform dynamic DNS updates.
Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a 'transfer job' routine.
The HTTP server for Cisco IOS versions 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands when local authorization is used by specifying a high access level in the URL.
Multiple buffer overflows in RADIUS daemon radiusd in (1) Merit 3.6b and (2) Lucent 2.1-2 allow remote attackers to cause a denial of service or execute arbitrary commands.
Buffer overflow in the Transparent Network Substrate (TNS) Listener in Oracle 8i version 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands STATUS, PING, SERVICES, TRC_FILE, SAVE_CONFIG, or RELOAD.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS