CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack triggered after invoking lpr 1000 times.
Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, allowing local users to gain privileges by decrypting the passwords.
thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename.
A vulnerability in Windows NT 4.0 SP4 and earlier allows local users to gain privileges by modifying the symbolic link table in the \?? object folder using a different case letter (upper or lower) to point to a different device.
Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.
Directory traversal vulnerability in nph-publish before version 1.2 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the pathname for an upload operation.
The SystemSoft SystemWizard package on HP Pavilion PCs with Windows 98, and possibly other platforms, installs two ActiveX controls marked as safe for scripting. This allows remote attackers to execute arbitrary commands via a malicious web page that references the Launch control or the RegObj control.
NetWare NFS mode 1 and 2 implements the 'Read Only' flag in Unix by changing the ownership of a file to root, allowing local users to gain root privileges by creating a setuid program and setting it to 'Read Only.'
The soundplayer program in IRIX allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program.
Buffer overflow in CamShot WebCam HTTP server allows remote attackers to execute commands via a long GET request.
The nviboot boot script in the Debian nvi package allows local users to delete files via malformed entries in vi.recover.
The ip_input.c file in BSD-derived TCP/IP implementations contains a vulnerability that allows remote attackers to cause a denial of service (crash or hang) via crafted packets.
Buffer overflow in the UnixWare rtpm program allows local users to gain privileges via a long environmental variable.
Trend Micro PC-Cillin does not restrict access to its internal proxy port, allowing remote attackers to conduct a denial of service.
The AltaVista search engine allows remote attackers to read files above the document root via a .. (dot dot) in the query.cgi CGI program.
Buffer overflow in CSM mail server allows remote attackers to cause a denial of service or execute commands via a long HELO command.
The SMS Remote Control program is installed with insecure permissions, allowing local users to gain privileges by modifying or replacing the program.
The bna_pass program in Optivity NETarchitect uses the PATH environmental variable for finding the 'rm' program, which allows local users to execute arbitrary commands.
Multiple unknown vulnerabilities in the 'r-cmnds' services (remshd, rexecd, rlogind, rlogin, remsh, rcp, rexec, rdist) for HP-UX versions 10.00 through 11.00 allow attackers to gain privileges or access files.
Macintosh systems generate large ICMP datagrams in response to malformed datagrams, allowing them to be used as amplifiers in a flood attack.