CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco Gigabit Switch routers running IOS allow remote attackers to forward unauthorized packets due to improper handling of the 'established' keyword in an access list.
The su program in Red Hat Linux does not log failed login attempts if the su process is killed before the timeout expires. This allows local attackers to conduct brute force password guessing.
The vulnerability in rpc.statd allows remote attackers to forward RPC calls to the local operating system via the SM_MON and SM_NOTIFY commands.
Multiple buffer overflows in the SMB authentication library (smbvalid/smbval), as used in Apache::AuthenSmb and possibly other modules, allow remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges.
The whois_raw.cgi CGI script in CDomain allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon.
Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command.
IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs with system level privileges.
The midikeys program in SGI IRIX allows local users to modify arbitrary files via a text editor.
Buffer overflows in Bisonware FTP server prior to version 4.1 allow remote attackers to cause a denial of service and possibly execute arbitrary commands via long (1) USER, (2) LIST, or (3) CWD commands.
MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste a file name into the file upload intrinsic control, a variant of 'untrusted scripted paste'.
SSH server (sshd2) before version 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs.
The AV option for MS Exchange Server in InoculateIT 4.53, and possibly other versions, only scans the Inbox folder tree. This could allow viruses to escape detection if user rules cause messages to be moved to different mailboxes.
Buffer overflow in Solaris lpset program allows local users to gain root access.
The inndstart program in INN allows local users to gain root privileges via the 'pathrun' parameter in the inn.conf file.
The inndstart program in INN allows local users to gain privileges by specifying an alternate configuration file using the INNCONF environmental variable.
Buffer overflow in the dtprintinfo program of Solaris may lead to unauthorized access to the system.
Internet Explorer with a security setting below Medium allows remote attackers to execute arbitrary commands via a malicious web page that uses the FileSystemObject ActiveX object.
The gnapster and knapster clients for Napster do not properly restrict access only to MP3 files, allowing remote attackers to read arbitrary files from the client by specifying the full pathname for the file.