CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.17)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability involves a Denial of Service (DoS) attack where an attacker sends many SYN packets to create multiple connections without sending an ACK packet, leading to system overload.
Transarc DCE Distributed File System (DFS) version 1.1 for Solaris 2.4 and 2.5 does not properly initialize the grouplist for users who belong to a large number of groups. This could allow those users to gain access to resources protected by DFS.
Bash before version 1.14.7 and tcsh 6.05 allow local users to gain privileges via directory names containing shell metacharacters. This can lead to the execution of commands enclosed in the directory name when the shell expands filenames.
Pine before version 3.94 allows local users to gain privileges via a symlink attack on a lockfile that is created when a user receives new mail.
In Solaris 2.4 before kernel jumbo patch -35, set-gid programs can dump core even if the real user id is not in the set-gid group. This allows local users to overwrite or create files with higher privileges.
The convert.bas program in the Novell web server allows remote attackers to read any file on the system that is internally accessible by the web server.
The manual page reader (man) in FreeBSD 2.2 and earlier allows local users to gain privileges via a sequence of commands.
CVE-1999-0019 vulnerability allows for file deletion or creation via rpc.statd due to invalid information.
dxconsole in DEC OSF/1 3.2C and earlier allows local users to read arbitrary files by specifying the file with the -file parameter.
The test-cgi program allows an attacker to list files on the server.
Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys.
UDP services like echo and chargen can be used together to flood the server, known as a UDP bomb or UDP packet storm.
Livingston portmaster machines could be rebooted via a series of commands.
Some configurations of NIS+ in Linux allowed attackers to log in as the user '+'.
A race condition in the Solaris ps command allows an attacker to overwrite critical files.
The SGI Desktop Permissions Tool in IRIX 6.0.1 and earlier allows local users to modify permissions for arbitrary files, potentially leading to privilege escalation.
Vulnerability in BSD Telnet client with encryption and Kerberos 4 authentication allows remote attackers to decrypt the session via sniffing.
Predictable TCP sequence numbers allow for connection spoofing.
rpc.lockd in Red Hat Linux 6.1 and 6.2 allows remote attackers to cause a denial of service via a malformed request.
Vulnerability in Support Watch (also known as SupportWatch) in HP-UX versions 8.0 through 9.0 allows local users to gain elevated privileges.