CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Quake 1 server responds to an initial UDP game connection request with a large amount of traffic, allowing remote attackers to use the server as an amplifier in a 'Smurf' style attack on another host by spoofing the connection request.
Netscape 4.7 records user passwords in the preferences.js file during an IMAP or POP session, even if the user has not enabled 'remember passwords.'
Buffer overflow in ZBServer Pro 1.50 allows remote attackers to execute commands via a long GET request.
Outlook Express 5 for Macintosh downloads attachments to HTML mail without prompting the user, known as the 'HTML Mail Attachment' vulnerability.
The default configurations for McAfee Virus Scan and Norton Anti-Virus do not scan files in the RECYCLED folder used by the Windows Recycle Bin. This allows attackers to store malicious code undetected.
A vulnerability in Solaris allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.
wmmon in FreeBSD allows local users to gain privileges via the .wmmonrc configuration file.
The vulnerability in Solaris dmispd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database.
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters.
IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll.
Buffer overflow in the i2odialogd daemon on UnixWare allows remote attackers to gain root access via a long username/password authorization string.
The Lotus Domino HTTP server does not properly disable anonymous access to the cgi-bin directory, which may lead to unauthorized access to resources.
Ipswitch IMail versions 5.0 and 6.0 use weak encryption to store passwords in registry keys, allowing local attackers to read passwords for e-mail accounts.
Buffer overflow in Lotus Domino HTTP server allows remote attackers to cause a denial of service via a long URL.
Buffer overflow in the Linux linuxconf package allows remote attackers to gain root privileges via a long parameter.
DNS PRO allows remote attackers to conduct a denial of service via a large number of connections.
wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.
The Groupwise web server (GWWEB.EXE) allows remote attackers to determine the real path of the web server via the HELP parameter.
The Groupwise web server (GWWEB.EXE) allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter.
Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS