CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Windows NT searches a user's home directory (%systemroot% by default) before other directories to find critical programs, which could allow local users to bypass access restrictions or gain privileges by placing a Trojan horse program into the root directory, which is writable by default.
Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server, which is then executed by Pine.
VMWare 1.0.1 for Linux has a buffer overflow due to a long HOME environmental variable.
Buffer overflow in Xi Graphics Accelerated-X server allows local users to gain root access via a long display or query parameter.
Buffer overflows in the Red Hat net-tools package may lead to unauthorized access or system crashes.
The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.
SpectroSERVER in Cabletron Spectrum Enterprise Manager 5.0 installs a directory tree with insecure permissions, allowing local users to replace a privileged executable (processd) with a Trojan horse.
Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.
The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack.
The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges.
Cisco Gigabit Switch routers running IOS allow remote attackers to forward unauthorized packets due to improper handling of the 'established' keyword in an access list.
The su program in Red Hat Linux does not log failed login attempts if the su process is killed before the timeout expires. This allows local attackers to conduct brute force password guessing.
The vulnerability in rpc.statd allows remote attackers to forward RPC calls to the local operating system via the SM_MON and SM_NOTIFY commands.
Multiple buffer overflows in the SMB authentication library (smbvalid/smbval), as used in Apache::AuthenSmb and possibly other modules, allow remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
The whois_raw.cgi CGI script in CDomain allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges.
Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon.
Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command.
IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs with system level privileges.
The midikeys program in SGI IRIX allows local users to modify arbitrary files via a text editor.