CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Raptor GFX configuration tool, pgxconfig, allows local users to gain privileges via a symlink attack.
Auction Weaver CGI script version 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the catdir parameter.
The URLConnection function in MacOS Runtime Java (MRJ) 2.1 and earlier and the Microsoft virtual machine (VM) for MacOS allows a malicious web site operator to connect to arbitrary hosts using HTTP redirection, violating the Java security model.
Umb-scheme version 3.2-11 for Red Hat Linux is installed with world-writable files.
Buffer overflows in the Raptor GFX configuration tool (pgxconfig) allow local users to gain elevated privileges via command line options.
Buffer overflow in the IBM Net.Data db2www CGI program allows remote attackers to execute arbitrary commands via a long PATH_INFO environmental variable.
The xlockmore and xlockf programs do not properly cleanse user-injected format strings, allowing local users to gain root privileges via the -d option.
O'Reilly WebSite Pro 2.3.7 installs the uploader.exe program with execute permissions for all users, allowing remote attackers to create and execute arbitrary files by directly calling uploader.exe.
The sshd program in the Rapidstream 2.1 Beta VPN appliance has a hard-coded 'rsadmin' account with a null password, allowing remote attackers to execute arbitrary commands via ssh.
The Gnome Lokkit firewall package before version 0.41 does not properly restrict access to some ports, even if a user does not make any services available.
Zope before 2.2.1 does not properly restrict access to the getRoles method, allowing users who can edit DTML to add or modify roles by modifying the roles list included in a request.
A format string vulnerability in the strong.exe program in NAI Net Tools PKI server 1.0 before HotFix 3 allows remote attackers to execute arbitrary code via format strings in a URL with a .XUDA extension.
Buffer overflow in the bdf program in HP-UX 11.00 may allow local users to gain root privileges via a long -t option.
Norton AntiVirus 5.00.01C with the Novell Netware client does not properly restart the auto-protection service after the first user has logged off of the system.
Buffer overflow in the IRIX libgl.so library allows local users to gain root privileges via a long HOME variable in programs such as gmemusage and gr_osview.
Buffer overflow in gr_osview in IRIX 6.2 and 6.3 allows local users to gain privileges via a long -D option.
The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, allowing remote attackers to add user accounts by directly calling the admin CGI script.
CVS server version 1.10.8 does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs. This allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then perform a CVS commit action.
Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.
BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.