CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The daytime service is running, which may lead to unauthorized access to time-related information.
The systat service is running, which may lead to the disclosure of system information.
The rstat/rstatd service is running, which may lead to unauthorized access to system information.
The rpc.sprayd service is running, which may lead to unauthorized access to the system.
The echo service is running, which may lead to information disclosure.
The rpc.rquotad service is running, which may lead to unauthorized access to quota system information.
The ident/identd service is running, which may lead to the disclosure of user information.
A network service is running on a nonstandard port, which may lead to difficulties in detection and monitoring.
Anonymous FTP is enabled, allowing users to access files without authentication.
ICMP echo (ping) is allowed from arbitrary hosts, which may lead to unauthorized network scanning.
The UUCP service is running, which may lead to unauthorized access to the system.
Linux versions 2.1.132 and earlier allow local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed.
Corel Word Perfect 8 for Linux creates a temporary working directory with world-writable permissions, allowing local users to modify Word Perfect behavior by editing files in the working directory or to modify other users' files via a symlink attack.
Internet Explorer versions 3.x to 4.01 allows a remote attacker to insert malicious content into a frame of another web site, known as frame spoofing.
KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.
Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into the file upload control, known as untrusted scripted paste.
Internet Explorer 4.0 and 4.01 allow a remote attacker to read files via IE's cross frame security, aka the 'Cross Frame Navigate' vulnerability.
Attackers can crash a Cisco IOS router or device, provided they can get to an interactive prompt (such as a login). This applies to some IOS 9.x, 10.x, and 11.x releases.
The dumpreg program in Red Hat Linux 5.1 opens /dev/mem with O_RDWR access, allowing local users to cause a denial of service (crash) by redirecting fd 1 (stdout) to the kernel.
cmdtool in OpenWindows 3.0 and XView 3.0 in SunOS 4.1.4 and earlier allows attackers with physical access to the system to display unechoed characters (such as those from password prompts) via the L2/AGAIN key.