CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netscape Navigator uses weak encryption for storing a user's Netscape mail password.
The Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for SSL connections. This allows a remote attacker to sniff usernames and passwords in plaintext.
IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege.
CuteFTP uses weak encryption to store password information in its tree.dat file.
The status.cgi CGI script in IMail IMONITOR allows remote attackers to cause a denial of service by making many calls to status.cgi.
The Network HotSync program in Handspring Visor lacks authentication, allowing remote attackers to access emails and files.
KDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories.
Allaire Spectra Webtop allows authenticated users to access other Webtop sections by specifying explicit URLs.
The Allaire Spectra Configuration Wizard allows remote attackers to cause a denial of service by repeatedly resubmitting data collections for indexing via a URL.
The WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML.
IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a dot to the end of the URL.
The 'AEDebug' registry key is installed with insecure permissions, allowing local users to modify the key to specify a Trojan Horse debugger that is automatically executed on a system crash.
Microsoft Exchange Server 5.5 and 5.0 does not properly handle malformed NNTP and SMTP data, which can lead to application errors.
Directory traversal vulnerability in nph-publish before version 1.2 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the pathname for an upload operation.
The snmpd server in the cmu-snmp package before version 3.3-1 in Red Hat Linux 4.0 is configured to allow remote attackers to read and write sensitive information.
Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker.
A memory leak in the SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service attack by sending a large number of queries.
The FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) by establishing many simultaneous passive (PASV) connections.
CascadeView TFTP server allows local users to gain privileges via a symlink attack.