CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The fwluser script in AIX eNetwork Firewall allows local users to write to arbitrary files via a symlink attack.
IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs with system level privileges.
A vulnerability in Netscape Communicator allows a remote attacker to use the 'about' protocol to gain access to browser information when JavaScript is embedded within the TITLE tag.
Buffer overflow in SmartDesk WebSuite allows remote attackers to cause a denial of service via a long URL.
The 'Password Security' option in the Control Panel for Apple Powerbooks allows attackers with physical access to the machine to bypass security by booting from an emergency startup disk and using a disk editor to modify the on/off toggle or password in the aaaaaaaAPWD file, which is normally inaccessible.
Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.
The midikeys program in SGI IRIX allows local users to modify arbitrary files via a text editor.
Counter.exe version 2.70 allows a remote attacker to cause a denial of service (hang) via an HTTP request ending in %0A (newline), leading to a malformed entry in the counter log that results in an access violation.
Counter.exe version 2.70 allows a remote attacker to cause a denial of service (hang) by sending a long argument.
Buffer overflow in Windows NT 4.0 help file utility via a malformed help file.
Buffer overflows in Bisonware FTP server prior to version 4.1 allow remote attackers to cause a denial of service and possibly execute arbitrary commands via long (1) USER, (2) LIST, or (3) CWD commands.
BisonWare FTP Server 4.1 and earlier allows remote attackers to cause a denial of service via a malformed PORT command that contains a non-numeric character and a large number of carriage returns.
MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste a file name into the file upload intrinsic control, a variant of 'untrusted scripted paste'.
Pegasus e-mail client 3.0 and earlier uses weak encryption to store POP3 passwords in the pmail.ini file, allowing local users to easily decrypt the passwords and read e-mail.
SSH server (sshd2) before version 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs.
The AV option for MS Exchange Server in InoculateIT 4.53, and possibly other versions, only scans the Inbox folder tree. This could allow viruses to escape detection if user rules cause messages to be moved to different mailboxes.
Alibaba HTTP server allows remote attackers to read files via a .. (dot dot) attack.
Vulnerability in Windows NT IIS server allows a DoS attack by sending a request containing the '..\.' sequence.
Microsoft Outlook Express before version 4.72.3612.1700 allows a malicious user to send a message containing '..', which can inadvertently cause Outlook to re-enter POP3 command mode and hang the POP3 session.
Buffer overflow in Solaris lpset program allows local users to gain root access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS