CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw in OpenStack Keystone allows a remote attacker to send a large HTTP request with a long tenant name when requesting a token, leading to excessive CPU and memory consumption and denial of service.
Mechanizm uwierzytelniania hasłem serwera WWW używany przez produkty jest podatny na ataki typu MitM oraz Replay. Skuteczne wykorzystanie tej podatności umożliwia nieautoryzowany dostęp do serwera WWW produktu, co pozwala na przeglądanie i modyfikowanie informacji o konfiguracji i diagnostyce produktu.
Buffer overflow vulnerability in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue. A remote attacker can cause a denial of service via a crafted HTML document.
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
A directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a '..' sequence in the file parameter to module.php, a different vector than CVE-2005-1439. This issue has been disputed by a reliable third party.
An unspecified vulnerability in BlazeDS 3.2 and earlier, used in LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion, allows remote attackers to obtain sensitive information via injected tags and external entity references in XML documents.
The updatePosition function in libexpat (Expat 2.0.1) has a buffer over-read vulnerability. Crafted UTF-8 sequences in an XML document can cause an application crash.
Multiple CSRF vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands. The attack involves requests to the /level/15/exec/- URI with the "show privilege" command and to the /level/15/exec/-/configure/http URI with the "alias exec" command.
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via the t, osticket_title, em, e, err parameters and the name and subject fields when adding a ticket.
Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets.
The ICQwebmail client for ICQ 2000A creates a world-readable temporary file during login and does not delete it, allowing local users to obtain sensitive information.
Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.
Windows NT and Windows 2000 allow a remote attacker to cause a denial of service via malformed DCE/RPC SMBwriteX requests that contain an invalid data length.
Savant web server allows remote attackers to read source code of CGI scripts via a GET request that does not include the HTTP version number.
Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog running on port 8002.
PassWD 1.2 uses weak encryption (trivial encoding) to store passwords, allowing an attacker with access to the password file to easily decrypt the passwords.
In HP-UX 10.20 and 11, local attackers can exploit a symlink attack to overwrite files.
Imate Webmail Server 2.5 allows remote attackers to cause a denial of service via a long HELO command.
xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized.
The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.