CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.15)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.
Heap overflow in the FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings.
Buffer overflow in the FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.
The Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users when bad passwords are entered, making it easier for remote attackers to conduct brute force password guessing attacks.
CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, allowing remote attackers to modify the password without knowing the original password.
The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, allowing Windows to accept DNS updates from hosts that it did not query. This enables remote attackers to poison the DNS cache.
Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766.
VAXstations running Open VMS versions 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts. This makes it easier for attackers to conduct brute force password guessing.
The default permissions of /dev/kmem in Linux versions before 2.0.36 allow IP spoofing.
Buffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command.
IP forwarding is enabled on a machine that is not a router or firewall, which may lead to unauthorized access to the network.
The INN daemon (innd) version 1.5 has a vulnerability that allows command execution via shell metachars in 'newgroup' and 'rmgroup' control messages, among others.
CVE-1999-0066 vulnerability concerns remote code execution in the AnyForm CGI script. This allows attackers to execute arbitrary commands on the server.
A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.
A vulnerability in the Linux kernel related to the libceph library has been resolved, concerning key length verification. The new CEPH_MAX_KEY_LEN check ensures that the key material fits into a fixed-size buffer.
An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.
An issue was discovered in py-lmdb 0.97 where mdb_page_touch does not properly set up mc->mc_pg[mc->top] for certain mp_flags values, leading to an invalid write operation. The vulnerability can be triggered by supplying a crafted data.mdb file.
The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability, leading to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation.
n8n to platforma automatyzacji procesów roboczych typu open source. Przed wersjami 2.14.1, 2.13.3 i 1.123.26, uwierzytelniony użytkownik z uprawnieniami do tworzenia lub modyfikowania procesów roboczych mógł wykorzystać tryb 'Combine by SQL' w węźle Merge do odczytu lokalnych plików na hoście n8n oraz uzyskać zdalne wykonanie kodu.
n8n to platforma automatyzacji procesów roboczych typu open source. Przed wersjami 1.123.10 i 2.5.0, podatności w węźle Git pozwalały uwierzytelnionym użytkownikom z uprawnieniami do tworzenia lub modyfikowania procesów roboczych na wykonywanie dowolnych poleceń systemowych lub odczytywanie dowolnych plików na hoście n8n.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS