CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in function/showprofile.php in FlexBB 0.5.5 allows remote attackers to execute arbitrary SQL commands and view all usernames and passwords via the id parameter to the showprofile page in index.php.
A buffer overflow vulnerability in the parse_url function of the RTSP module in Fenice 1.10 and earlier allows remote attackers to execute arbitrary code via a long URL.
The vulnerability in Asterisk Recording Interface (ARI) in Asterisk@Home before version 2.8 stores the recordings/includes/main.conf file under the web document root with insufficient access control, allowing remote attackers to obtain password information.
A vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code by injecting a URL into the DFORUM_PATH parameter across multiple scripts. Attackers can upload a malicious PHP file from an external server and execute it on the victim's server.
RI Blog 1.1 is vulnerable to SQL injection in the username and password fields. Remote attackers can execute arbitrary SQL commands, leading to unauthorized database access.
In SL_site 1.0, the page.php file is vulnerable to SQL injection via the id_page parameter, allowing remote attackers to execute arbitrary SQL commands. This issue can also lead to reflected XSS through error messages.
A PHP remote file inclusion vulnerability in agenda.php3 of phpMyAgenda 3.0 Final and earlier allows attackers to execute arbitrary PHP code by supplying a URL in the rootagenda parameter. This can lead to full server compromise.
An off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.
An eval injection vulnerability in index.php of ClanSys 1.1 allows remote attackers to execute arbitrary PHP code by injecting PHP code into the 'page' parameter. The attack can involve injecting an 'include' statement, leading to code execution.
SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter. The affected version is disputed by the vendor, who states the issue was fixed in version 2.3.4.
PHP remote file inclusion vulnerability in movie_cls.php of Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path parameter.
Multiple SQL injection vulnerabilities in check_login.asp in Bloggage allow remote attackers to execute arbitrary SQL commands via the acc_name and password parameters.
A heap-based buffer overflow in Winny 2.0 b7.1 and earlier allows remote attackers to execute arbitrary code by sending long strings to certain commands on the file transfer port.
A vulnerability in Symantec Scan Engine 5.0.0.24 and earlier versions before 5.1.0.7 uses client-side password verification. A remote attacker can bypass authentication and gain administrator privileges by sending modified XML requests.
An argument injection vulnerability in Beagle before version 0.2.5 allows attackers to execute arbitrary commands via crafted filenames. When Beagle launches external helper applications during indexing, injected command line arguments are processed.
A heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, used by applications employing ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images.
Apple Safari 2.0.3 contains a vulnerability that allows remote attackers to cause a denial of service and potentially execute code by sending a malicious CELLSPACING attribute in a TABLE tag, triggering an error in KWQListIteratorImpl::KWQListIteratorImpl.
SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier. Remote attackers can execute arbitrary SQL commands via the flexbb_username COOKIE parameter.
Apple Safari 2.0.3 contains a vulnerability that allows remote attackers to cause a denial of service and potentially execute code via an invalid FRAME tag. The issue may be due to multiple SCROLLING attributes with no values or a SRC attribute with no value.
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer. An attacker can execute arbitrary code remotely by supplying a crafted URL in the rf parameter.