CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ColdFusion ClusterCATS appends stale query string arguments to a URL during HTML redirection, which may provide sensitive information to the redirected site.
The on-line help system options in Cisco routers allows non-privileged users to obtain sensitive information via the show command.
In SuSE Linux 6.3 and earlier versions, the aaa_base component allows local users to delete arbitrary files by creating files with names that include spaces. These files are incorrectly interpreted by aaa_base when it deletes expired files from the /tmp directory.
The Allaire Spectra container editor preview tool does not properly enforce object security, allowing an attacker to conduct unauthorized activities via an object-method added to the container object with a publishing rule.
The MSWordView application in IMP creates world-readable files in the /tmp directory, allowing other local users to read potentially sensitive information.
The OpenLDAP server on Linux allows local users to modify arbitrary files via a symlink attack.
The Windows 2000 domain controller allows a malicious user to modify Active Directory information by modifying an unprotected attribute, known as the 'Mixed Object Access' vulnerability.
Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.
Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL.
The make-temp-name function in Emacs 20 creates temporary files with predictable names, allowing attackers to conduct a symlink attack.
Panda Security 3.0 with registry editing disabled allows users to edit the registry and gain privileges by directly executing a .reg file or using other methods.
The X fontserver (xfs) allows local users to cause a denial of service by sending malformed input to the server.
The X font server (xfs) in Red Hat Linux 6.x allows an attacker to cause a denial of service via a malformed request.
The Linux trustees kernel patch allows attackers to cause a denial of service by accessing a file or directory with a long name.
BeOS versions 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37.
CRYPTOCard CryptoAdmin for PalmOS uses weak encryption to store a user's PIN number, allowing an attacker with access to the .PDB file to generate valid PT-1 tokens after cracking the PIN.
Buffer overflow in the RealNetworks RealPlayer client versions 6 and 7 allows remote attackers to cause a denial of service via a long Location URL.
A remote attacker can read information from a Netscape user's cache via JavaScript.
Microsoft TCP/IP Printing Services, also known as Print Services for Unix, allows an attacker to cause a denial of service via a malformed TCP/IP print request.
Buffer overflow in the Napster client beta 5 allows remote attackers to cause a denial of service via a long message.