CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The seed generation mechanism in the S/Key authentication system in Check Point VPN-1/FireWall-1 version 4.1 and earlier allows remote attackers to bypass authentication via a brute force attack.
Buffer overflow in the web authorization form of Mobius DocumentDirect for the Internet 1.2 allows remote attackers to cause a denial of service or execute arbitrary commands via a long username.
Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header.
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, allowing local attackers to execute arbitrary commands via functions such as gettext and catopen.
The administration module in Sun Java web server allows remote attackers to execute arbitrary commands by uploading Java code to the module and invoking the JspServlet.
The OPSEC communications authentication mechanism (fwn1) in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to spoof connections, aka the 'OPSEC Authentication Vulnerability.'
The mailto CGI script allows remote attacker to execute arbitrary commands via shell metacharacters in the emailadd form field.
The -ftrapv compiler option in gcc and g++ version 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to overflow-related vulnerabilities.
The installation of Tumbleweed Messaging Management System (MMS) 4.6 and earlier creates a default account 'sa' with no password.
Auction Weaver CGI script version 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the catdir parameter.
The Raptor GFX configuration tool, pgxconfig, allows local users to gain privileges via a symlink attack.
The administration interface for the dwhttpd web server in Solaris AnswerBook2 allows interface users to remotely execute commands via shell metacharacters.
Buffer overflows in ntop running in web mode allows remote attackers to execute arbitrary commands.
Buffer overflow in University of Minnesota (UMN) gopherd 2.x allows remote attackers to execute arbitrary commands via a DES key generation request (GDESkey) that contains a long ticket value.
Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name.
The sysgen service in Aptis Totalbill does not perform authentication, allowing remote attackers to gain root privileges by connecting to the service and specifying commands to be executed.
Checkpoint Firewall-1 with the RSH/REXEC setting enabled allows remote attackers to bypass access restrictions and connect to a RSH/REXEC client via malformed connection requests.
The truncate function in IRIX 6.x does not properly check for privileges when the file is in the xfs file system, allowing local users to delete the contents of arbitrary files.
BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, allowing remote attackers to spoof the eTrust administrator and gain privileges.