CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The default configuration of Big Brother 1.4h2 and earlier does not include proper access restrictions, allowing remote attackers to execute arbitrary commands by uploading files that will be executed as CGI scripts by the web server.
The 'capabilities' feature in Linux before version 2.2.16 allows local users to cause a denial of service or gain privileges by setting capabilities to prevent a setuid program from dropping privileges.
The userreg.cgi CGI program in MailStudio 2000 version 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.
Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
IBM WebSphere server version 3.0.2 allows a remote attacker to view the source code of a JSP program by requesting a URL with the JSP extension in upper case.
The default configuration of BEA WebLogic versions 3.1.8 through 4.5.1 allows a remote attacker to view the source code of a JSP program by requesting a URL with the JSP extension in upper case.
OpenSSH does not properly drop privileges when the UseLogin option is enabled, allowing local users to execute arbitrary commands by providing the command to the ssh daemon.
A FreeBSD patch for SSH on January 14, 2000, configures SSH to listen on port 722 as well as port 22, which might allow remote attackers to access SSH through port 722 even if port 22 is otherwise filtered.
Buffer overflow in the HTTP proxy server for the i-drive Filo software allows remote attackers to execute arbitrary commands via a long HTTP GET request.
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, allowing local users to modify SNMP configuration or gain privileges.
A buffer overflow in the restore program version 0.4b17 and earlier in the dump package allows local users to execute arbitrary commands via a long tape name.
Buffer overflow in the logging feature of EServ 2.9.2 and earlier allows an attacker to execute arbitrary commands via a long MKD command.
Buffer overflow in HP Openview Network Node Manager 6.1 allows remote attackers to execute arbitrary commands via the Alarm service (OVALARMSRV) on port 2345.
Shiva Access Manager 5.0.0, when configured to store configuration information in an LDAP directory, stores the DN (Distinguished Name) and password in cleartext in a file that is world readable. This allows local users to compromise the LDAP server.
Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to execute arbitrary commands via a long GET request.
BRU backup software allows local users to append data to arbitrary files by specifying an alternate configuration file with the BRUEXECLOG environmental variable.
xinetd version 2.1.8.x does not properly restrict connections when hostnames are used for access control and the connecting host does not have a reverse DNS entry.
The system does not present an appropriate legal message or warning to a user who is accessing it.
The Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a malformed authentication request.
Buffer overflow in splitvt version 1.6.3 and earlier allows local users to gain root privileges via a long password in the screen locking function.