CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds.
The email client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files home.fc, network.fc, or FCCLIENT.LOG.
Microsoft HTML control used in Internet Explorer 5.0, FrontPage Express, Outlook Express 5, and Eudora allows remote malicious websites or HTML emails to cause a denial of service through large HTML form fields, leading to 100% CPU consumption.
CVE-1999-0939 affects the IRC Epic/epic4 client in Debian, which is vulnerable to a denial of service (DoS) attack via a long string.
Internet Explorer 5.0 records the username and password for FTP servers in the URL history, which could allow local users to read the information from another user's index.dat or people physically observing another user to read the information from the status bar when the user hovers the mouse over a link.
Microsoft FrontPage stores form results in a default location at /_private/form_results.txt, which is world-readable and accessible in the document root. This allows remote attackers to read possibly sensitive information submitted by other users.
Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), allowing remote attackers to perform spoofing and session hijacking.
The pt_chown command in Linux allows local users to modify TTY terminal devices that belong to other users.
The scriptlet.typelib ActiveX control is marked as 'safe for scripting' for Internet Explorer, allowing a remote attacker to execute arbitrary commands, as demonstrated by the Bubbleboy attack.
Man2html 2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
Remote attackers can cause a denial of service on Linux through a malformed TERM environmental variable in the telnetd daemon.
The default configuration of in.identd in SuSE Linux waits 120 seconds between requests, allowing a remote attacker to conduct a denial of service.
A vulnerability in dbsnmp in Oracle Intelligent Agent allows local users to gain elevated privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to locate the nmiconf.tcl script.
The 3Com HiPer Access Router Card (HiperARC) versions 4.0 through 4.2.29 is vulnerable to a denial of service attack that can cause the device to reboot. Attackers can exploit this by flooding the telnet port with IAC packets.
Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function.
Vulnerability in IIS 4.0 allows a denial of service attack by flooding the server with HTTP requests containing malformed headers.
Check Point FireWall-1 is vulnerable to a denial of service attack that can be executed via UDP packets sent through VPN-1 to port 0 of a host.
The Windows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated, potentially leading to a denial of service.
The sdtcm_convert function in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.