CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a non-existent file, which generates an error message revealing the path.
UltraBoard version 1.6 and other versions allow remote attackers to cause a denial of service by referencing UltraBoard in the Session parameter, which causes UltraBoard to fork copies of itself.
The db.cgi CGI script in DBMan by Gossamer Threads allows remote attackers to view environmental variables and setup information by referencing a non-existing database in the db parameter.
Buffer overflow in the Netwin DNEWSWEB CGI program allows remote attackers to execute arbitrary commands via long parameters such as group, cmd, and utag.
The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the owner's PIN by resetting the PIN in the EEPROM.
Vulnerability in the shutdown command for HP-UX 11.X and 10.X allows local users to gain privileges via malformed input variables.
Quake3 Arena allows malicious server operators to read or modify files on a client via a dot dot (..) attack.
UltraBoard.pl or UltraBoard.cgi CGI scripts in UltraBoard 1.6 allow remote attackers to read arbitrary files via a pathname string that includes a dot dot (..) and ends with a null byte.
Cart32 allows remote attackers to access sensitive debugging information by appending /expdate to the URL request.
FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.
The system is infected with malware for conducting distributed denial of service (DDoS) attacks, such as Trinoo, TFN, TFN2K, stacheldraht, mstream, or shaft.
AppleShare IP 6.1 and later allows a remote attacker to read potentially sensitive information via an invalid range request to the web server.
The aaa_base package in SuSE installs some system accounts with home directories set to /tmp, allowing local users to gain privileges to those accounts by creating standard user startup scripts such as profiles.
Windows 95 and Windows 98 allow a remote attacker to cause a denial of service via a NetBIOS session request packet with a NULL source name.
The WebShield SMTP Management Tool version 4.5.44 does not properly restrict access to the management port when an IP address does not resolve to a hostname, allowing remote attackers to access the configuration via the GET_CONFIG command.
The knfsd NFS server in Linux kernel 2.2.x allows remote attackers to cause a denial of service via a negative size value.
NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option.
ATRIUM Cassandra NNTP Server 1.10 allows remote attackers to cause a denial of service via a long login name.
Meeting Maker uses weak encryption (a polyalphabetic substitution cipher) for passwords, allowing remote attackers to sniff and decrypt passwords for Meeting Maker accounts.
pcAnywhere versions 8.x and 9.0 are vulnerable to a denial of service attack that can be executed by remote attackers via a TCP SYN scan, for example using nmap.