CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
UltraBoard version 1.6 and other versions allow remote attackers to cause a denial of service by referencing UltraBoard in the Session parameter, which causes UltraBoard to fork copies of itself.
The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the owner's PIN by resetting the PIN in the EEPROM.
Vulnerability in the shutdown command for HP-UX 11.X and 10.X allows local users to gain privileges via malformed input variables.
Cart32 allows remote attackers to access sensitive debugging information by appending /expdate to the URL request.
Quake3 Arena allows malicious server operators to read or modify files on a client via a dot dot (..) attack.
UltraBoard.pl or UltraBoard.cgi CGI scripts in UltraBoard 1.6 allow remote attackers to read arbitrary files via a pathname string that includes a dot dot (..) and ends with a null byte.
AppleShare IP 6.1 and later allows a remote attacker to read potentially sensitive information via an invalid range request to the web server.
Windows 95 and Windows 98 allow a remote attacker to cause a denial of service via a NetBIOS session request packet with a NULL source name.
FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.
The system is infected with malware for conducting distributed denial of service (DDoS) attacks, such as Trinoo, TFN, TFN2K, stacheldraht, mstream, or shaft.
The aaa_base package in SuSE installs some system accounts with home directories set to /tmp, allowing local users to gain privileges to those accounts by creating standard user startup scripts such as profiles.
The WebShield SMTP Management Tool version 4.5.44 does not properly restrict access to the management port when an IP address does not resolve to a hostname, allowing remote attackers to access the configuration via the GET_CONFIG command.
NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option.
The knfsd NFS server in Linux kernel 2.2.x allows remote attackers to cause a denial of service via a negative size value.
ATRIUM Cassandra NNTP Server 1.10 allows remote attackers to cause a denial of service via a long login name.
pcAnywhere versions 8.x and 9.0 are vulnerable to a denial of service attack that can be executed by remote attackers via a TCP SYN scan, for example using nmap.
Meeting Maker uses weak encryption (a polyalphabetic substitution cipher) for passwords, allowing remote attackers to sniff and decrypt passwords for Meeting Maker accounts.
Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name.
Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user.
mail.local in Sendmail 8.10.x does not properly identify the . string which indicates the end of message text. This allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in . .