CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user.
mail.local in Sendmail 8.10.x does not properly identify the . string which indicates the end of message text. This allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in . .
IMP does not remove files properly if the MSWordView application quits, allowing local users to cause a denial of service by filling up disk space by requesting a large number of documents and prematurely stopping the request.
Qpopper versions 2.53 and 3.0 improperly identify the string that marks the end of message text. This allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 1023 characters long and ends in .
Cisco IOS versions 11.x and 12.x allow remote attackers to cause a denial of service by sending the ENVIRON option to the Telnet daemon before it is ready, resulting in a system reboot.
Buffer overflow in Microsoft command processor (CMD.EXE) for Windows NT and Windows 2000 allows a local user to cause a denial of service via a long environment variable.
Cisco Catalyst 5.4.x allows a user to gain access to the 'enable' mode without a password.
The Adtran MX2800 M13 Multiplexer is vulnerable to a denial of service attack that can be executed remotely via a ping flood to the Ethernet interface, causing the device to crash.
The read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, allowing an attacker to read unencrypted passwords.
HP asecure creates the Audio Security File audio.sec with insecure permissions, allowing local users to cause a denial of service or gain additional privileges.
Panda Security 3.0 allows users to uninstall the Panda software via its Add/Remove Programs applet.
Buffer overflow in Star Office 5.1 allows attackers to cause a denial of service by embedding a long URL within a document.
The dansie shopping cart application (cart.pl) allows remote attackers to access the shopping cart database and configuration information via a URL referencing the env, db, or vars form variables.
The default installation of IRIX Performance Copilot allows remote attackers to access sensitive system information via the pmcd daemon.
The AVM KEN! ISDN Proxy server allows remote attackers to cause a denial of service via a malformed request.
The AVM KEN! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack.
The vulnerability in Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable.
The webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. (dot dot) attack on the webplus CGI program.
The Sybase PowerDynamo personal web server allows attackers to read arbitrary files through a .. (dot dot) attack.
The dansie shopping cart application (cart.pl) allows remote attackers to execute commands via shell metacharacters in a form variable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS