CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in the sadc program on IBM AIX 4.1 through 4.3 allows local users to overwrite arbitrary files via a symlink attack when called from programs like timex that have the setgid bit set to adm.
Quake 2 server version 3.13 on Linux does not properly check file permissions for the config.cfg configuration file, allowing local users to read arbitrary files via a symlink from config.cfg to the target file.
KDE beta 3 screen savers allow local users to overwrite arbitrary files via a symlink attack on the .kss.pid file.
DIT TransferPro installs devices with world-readable and world-writable permissions, which could allow local users to damage disks through the ff device driver.
Gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files.
The SGI syserr program allows local users to corrupt files.
The open() function in FreeBSD allows local attackers to write to arbitrary files.
IMAP 4.1 BETA, and possibly other versions, does not properly handle the SIGABRT (abort) signal, which allows local users to crash the server (imapd) via certain sequences of commands, leading to a core dump that may contain sensitive password information.
The asynchronous I/O facility in the 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, allowing local users to cause a denial of service.
Internet Explorer 3 records a history of all URLs visited by a user in DAT files located in the Temporary Internet Files and History folders. These files are not cleared when the 'Clear History' option is selected and are not visible when browsing the folders due to tailored displays.
JavaScript in Internet Explorer 3.x and 4.x, and Netscape 2.x, 3.x and 4.x allows remote attackers to monitor a user's web activities, known as the Bell Labs vulnerability.
A DNS server allows zone transfers.
In Solaris 2.3 through 2.6, the ping command allows local users to cause a system crash by sending a ping request to a multicast address through the loopback interface.
The mj_key_cache program in MajorCool allows local users to modify files via a symlink attack.
CVE-1999-0144 vulnerability affects Qmail and allows for a denial of service attack by specifying a large number of recipients using the RCPT command.
SunOS 4.1.4 on a Sparc 20 machine allows local users to cause a denial of service (kernel panic) by reading from the /dev/tcx0 TCX device.
In Solaris 2.x, SunOS 4.x, and other BSD-based operating systems prior to version 4.4, access permissions for UNIX domain sockets are ignored. This could allow local users to connect to the socket and potentially disrupt or control the operations of the program using that socket.
Vulnerability in AIX 4.1.4 and HP-UX 10.01 and 9.05 allows local users to cause a denial of service (crash) by using a socket to connect to a port on the localhost, calling shutdown to clear the socket, then using the same socket to connect to a different port on localhost.
A version of the finger service is running, exposing valid user information to any entity on the network.
The finger service allows recursive searches using a long string of @ symbols.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS