CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, allowing local users to gain access to Excite accounts by modifying the file.
The installation of the fsp package version 2.71-10 in Debian GNU/Linux 2.0 adds the anonymous FTP user without notifying the administrator, which could automatically enable anonymous FTP on some servers such as wu-ftp.
Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions, including the setgid bit.
KDE allows local users to execute arbitrary commands by setting the KDEDIR environmental variable, which modifies the search path that KDE uses to locate its executables.
KDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file.
KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.
Buffer overflow in kppp in KDE allows local users to gain root access via a long PATH environmental variable.
The Vacation program allows remote users to execute commands through the sendmail command.
The installation of 1ArcServe Backup and Inoculan AV client modules for Exchange creates a log file, exchverify.log, which contains usernames and passwords in plaintext.
The CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user's console session when the host is an NIS+ client, allowing others with physical access to log in with any string.
ICQ 98 beta on Windows NT leaks the internal IP address of a client in the TCP data segment of an ICQ packet instead of the public address, which may lead to the leakage of sensitive information about the client or internal network configuration.
HAMcards Postcard CGI script version 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.
The LakeWeb Mail List CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.
LakeWeb Filemail CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address.
Buffer overflow in ssh 1.2.26 client with Kerberos V enabled could allow remote attackers to cause a denial of service or execute arbitrary commands via a long DNS hostname that is not properly handled during TGT ticket passing.
NukeNabber allows remote attackers to cause a denial of service by connecting to the NukeNabber port (1080) without sending any data, which causes the CPU usage to rise to 100% from the report.exe program that is executed upon the connection.
CVE-1999-0052 concerns IP fragmentation in FreeBSD that can lead to system crashes. A remote attacker can exploit this vulnerability to cause unexpected system downtime.
A hidden SNMP community string in HP OpenView allows remote attackers to modify MIB tables and obtain sensitive information.
BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file.
AIX infod allows local users to gain root access through an X display.