CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Nosque MsgCore 2.14 stores passwords in cleartext, potentially allowing local users to gain privileges. The administrator password is stored in the AdmPasswd registry key, and user passwords in the Userbase.dbf data file.
gFTP FTP client version 1.13 and earlier versions before 2.0.0 records a password in plaintext in (1) the log window, or (2) in a log file.
UnityMail allows remote attackers to conduct a denial of service via a large number of MIME headers.
Buffer overflow in Netscape Communicator occurs via EMBED tags in the pluginspage option.
The Compaq Integration Maintenance Utility in versions prior to SmartStart 4.50 modifies the legal notice caption and text in Windows NT, which could lead to a violation of security policy.
Buffer overflow in the Eyedog ActiveX control allows a remote attacker to execute arbitrary commands.
The Eyedog ActiveX control is marked as 'safe for scripting' for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.
The 'download behavior' in Internet Explorer 5 allows remote attackers to read arbitrary files via a server-side redirect.
A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds.
The email client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files home.fc, network.fc, or FCCLIENT.LOG.
Microsoft HTML control used in Internet Explorer 5.0, FrontPage Express, Outlook Express 5, and Eudora allows remote malicious websites or HTML emails to cause a denial of service through large HTML form fields, leading to 100% CPU consumption.
CVE-1999-0939 affects the IRC Epic/epic4 client in Debian, which is vulnerable to a denial of service (DoS) attack via a long string.
Internet Explorer 5.0 records the username and password for FTP servers in the URL history, which could allow local users to read the information from another user's index.dat or people physically observing another user to read the information from the status bar when the user hovers the mouse over a link.
Microsoft FrontPage stores form results in a default location at /_private/form_results.txt, which is world-readable and accessible in the document root. This allows remote attackers to read possibly sensitive information submitted by other users.
Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), allowing remote attackers to perform spoofing and session hijacking.
The pt_chown command in Linux allows local users to modify TTY terminal devices that belong to other users.
The scriptlet.typelib ActiveX control is marked as 'safe for scripting' for Internet Explorer, allowing a remote attacker to execute arbitrary commands, as demonstrated by the Bubbleboy attack.
Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
Man2html 2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
Remote attackers can cause a denial of service on Linux through a malformed TERM environmental variable in the telnetd daemon.