CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Race condition in xterm allows local users to modify arbitrary files via the logging option.
Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account. This allows any local or remote attacker who gains access to the oracle account to gain privileges or modify arbitrary files by altering the configuration file.
The ARP protocol allows any host to spoof ARP replies and poison the ARP cache, potentially leading to IP address spoofing or denial of service attacks.
The _writers property in NeXT NetInfo allows local users to gain root privileges or conduct a denial of service attack.
The asynchronous I/O facility in the 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, allowing local users to cause a denial of service.
Remote attackers can cause a denial of service in FTP by issuing multiple PASV commands, causing the server to run out of available ports.
Lotus cc:Mail release 8 stores the postoffice password in plaintext in a hidden file with insecure permissions.
Linux implementations of TFTP would allow access to files outside the restricted directory.
The vulnerability allows remote execution of arbitrary commands through the Guestbook CGI program.
Apache httpd versions 1.1.1 and earlier are vulnerable to cookie buffer overflow.
HP-UX 9.x and 10.x running X windows may allow local attackers to gain privileges via vuefile, vuepad, dtfile, or dtpad, which do not authenticate users.
The CGI handler program in IRIX allows arbitrary command execution, posing a serious security threat.
The newdsn.exe CGI script in IIS allows remote users to overwrite files.
The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs.
The bugfiler program in AIX allows local users to gain root access.
The Character-Terminal User Environment (CUE) in HP-UX 11.0 and earlier allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the IOERROR.mytty file.
Majordomo 1.94.3 and earlier allows remote attackers to execute arbitrary commands when the advertise or noadvertise directive is used in a configuration file, via shell metacharacters in the Reply-To header.
The vulnerability in rpc.mountd on Linux, Ultrix, and possibly other operating systems allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists.
The spaceball program in SpaceWare 7.3 v1.0 on IRIX 6.2 allows local users to gain root privileges by setting the HOSTNAME environmental variable to contain commands to be executed.
Vulnerability in CGI program in the Lasso application by Blue World, as used on WebSTAR and other servers, allows remote attackers to read arbitrary files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS