CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the nfs-utils package in various Linux distributions, rpc.statd does not properly cleanse untrusted format strings, allowing remote attackers to gain root privileges.
Buffer overflow in Infopulse Gatekeeper 3.5 and earlier allows remote attackers to execute arbitrary commands via a long string.
The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters.
A race condition in Samba's smbmnt allows local users to mount file systems in arbitrary locations.
The default configuration of the Sun Java web server 2.0 and earlier allows remote attackers to execute arbitrary commands by uploading Java code to the server via board.html, then directly calling the JSP compiler servlet.
Vulnerability in the rmt command in the dump package 0.4b4 allows a local user to gain root privileges.
The bb-hostsvc.sh script in Big Brother 1.4h1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack on the HOSTSVC parameter.
The example script source.asp in the Apache ASP module Apache::ASP version 1.93 and earlier allows remote attackers to modify files.
The Tnef program in Linux systems allows remote attackers to overwrite arbitrary files via TNEF encoded compressed attachments that specify absolute path names for the decompressed output.
The view_page.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters.
Savant web server allows remote attackers to execute arbitrary commands via a long GET request.
Guild FTPd allows remote attackers to determine the existence of files outside the FTP root via a .. (dot dot) attack, which provides different error messages depending on whether the file exists or not.
The ClientTrust program in Novell BorderManager does not properly verify the origin of authentication requests, which could allow remote attackers to impersonate another user by replaying the authentication requests and responses from port 3024 of the victim's machine.
The lreply function in wu-ftpd version 2.6.0 and earlier does not properly cleanse an untrusted format string, allowing remote attackers to execute arbitrary commands via the SITE EXEC command.
SSH 1.2.27 with Kerberos authentication support stores Kerberos tickets in a file created in the current directory of the user logging in. This could allow remote attackers to sniff the ticket cache if the home directory is installed on NFS.
Poll It 2.0 CGI script allows remote attackers to read arbitrary files by specifying the file name in the data_dir parameter.
makewhatis in the Linux man package allows local users to overwrite files via a symlink attack.
Buffer overflow in Canna input system allows remote attackers to execute arbitrary commands via an SR_INIT command with a long user name or group name.
Buffer overflow in Dalnet IRC server 4.6.5 allows remote attackers to cause a denial of service or execute arbitrary commands via the SUMMON command.
Buffer overflow in iMesh 1.02 allows remote attackers to execute arbitrary commands via a long string to the iMesh port.