CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in Yamaha MidiPlug occurs via a Text variable in an EMBED tag.
HP Secure Web Console uses weak encryption, which may expose data to unauthorized access.
The idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file.
Buffer overflow in HHOpen ActiveX control (hhopen.ocx) version 1.0.0.1 for Internet Explorer 4.01 and 5 allows remote attackers to execute arbitrary commands via long arguments to the OpenHelp method.
Netscape Messaging Server versions 3.54, 3.55, and 3.6 allow a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands.
The Falcon web server allows remote attackers to determine the absolute path of the web root via long file names.
URL Live! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack.
LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in calls to SamrOpenDomain, SamrEnumDomainUsers, and SamrQueryDomainInfo.
Falcon web server allows remote attackers to read arbitrary files via a .. (dot dot) attack.
The idle locking function in MacOS 9 allows local users to bypass password protection of locked sessions. A user can select the 'Log Out' option and then 'Cancel' in the dialog box, which returns them to the locked session.
The Zeus web server administrative interface uses weak encryption for storing passwords.
Cdwtools version 093 and earlier allows local users to gain root privileges via the /tmp directory.
Linux kernel before 2.3.18 or 2.2.13pre15 with SLIP and PPP options allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices.
CVE-1999-0905 affects the Axent Raptor firewall, which is vulnerable to a denial of service (DoS) attack via malformed zero-length IP options.
The ICQ ActiveList Server allows remote attackers to cause a denial of service (crash) by sending malformed packets to the server's UDP port.
Pluggable Authentication Modules (PAM) in Red Hat Linux 6.1 does not properly lock access to disabled NIS accounts.
The HTTP server for Xerox DocuColor 4 LP allows remote attackers to cause a denial of service (hang) via a long URL that contains a large number of '.' characters.
Directory traversal vulnerability in Jana proxy web server 1.40 allows remote attackers to read arbitrary files via a modified '......' attack.
Directory traversal vulnerability in Jana proxy web server 1.45 allows remote attackers to read arbitrary files via a .. (dot dot) attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS