CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The BuildDisk program on NeXT systems before version 2.0 does not prompt users for the root password, allowing local users to gain root privileges.
Vulnerability in NeXT 1.0a and 1.0 allows local users to gain privileges via a combination of the npd program and weak directory permissions.
Vulnerability in the restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.
Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental variable.
Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.
Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin.
Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user.
Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.
The CWD ~root command in the ftpd server allows root access to the system.
The debug command in Sendmail is enabled, allowing attackers to execute commands as root.
A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.
Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.
Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
Wersje pakietu semver przed 7.5.2 są podatne na atak Denial of Service (DoS) za pomocą wyrażeń regularnych (ReDoS) poprzez funkcję new Range, gdy nieufne dane użytkownika są dostarczane jako zakres.
Pakiet npm serialize-javascript (wersje <= 7.0.2) zawiera podatność na wstrzykiwanie kodu. Jest to niekompletne rozwiązanie dla CVE-2020-7660.
protobufjs kompiluje definicje protobuf do funkcji JavaScript. W wersjach przed 7.5.6 i 8.0.2, protobufjs pozwalał na przechodzenie przez dziedziczone właściwości obiektów podczas stosowania opcji, co mogło prowadzić do nieprawidłowego przetwarzania opcji.
W wersjach przed 7.5.6 i 8.0.2, protobufjs używał zwykłych obiektów z dziedziczonymi prototypami do wewnętrznych tabel wyszukiwania typów. Jeśli Object.prototype został wcześniej zanieczyszczony, te tabele wyszukiwania mogły być narażone na ataki.
Picomatch to matcher glob napisany w JavaScript. Wersje przed 4.0.4, 3.0.2 i 2.3.2 są podatne na atak typu Regular Expression Denial of Service (ReDoS) podczas przetwarzania stworzonych wzorców extglob.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS