CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.
SQL injection vulnerability in index.php of MyBB (MyBulletinBoard) before version 1.04. A remote attacker can execute arbitrary SQL commands via the referrer parameter.
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer. An attacker can execute arbitrary code remotely by supplying a crafted URL in the rf parameter.
SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in plexcart.pl of NicPlex PlexCart X3 and earlier. Remote attackers can execute arbitrary SQL commands via the catid parameter.
Multiple SQL injection vulnerabilities exist in plexum.php of NicPlex Plexum X5 and earlier. Remote attackers can execute arbitrary SQL commands via the pagesize, maxrec, and startpos parameters.
The config.php file in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values stored in config.php that are later executed. The provenance of this information is unknown; details are obtained solely from third party information.
SQL injection vulnerability in member.php of Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.
Multiple SQL injection vulnerabilities were found in myEvent 1.x. Remote attackers can manipulate the event_id and event_desc parameters to execute arbitrary SQL commands.
PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3. An attacker can remotely execute arbitrary PHP code by providing a URL in the page parameter.
Multiple unspecified vulnerabilities in the Email Server component of Oracle Collaboration Suite versions 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1. These flaws have unknown impact and attack vectors, identified as OCS01, OCS02, OCS03, and OCS04.
Unspecified vulnerability in the Export component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2. Details on impact and attack vectors are unknown, and Oracle has not confirmed if this is the same issue as CVE-2006-2081.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, and 9.2.0.7. Impact and attack vectors are unknown.
An unspecified vulnerability in Oracle Spatial allows SQL injection via MDSYS.PRVT_IDX functions. The flaw affects Oracle Database versions 8.1.7.4, 9.0.1.5, and 9.2.0.6.
Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications version 11.5.10 in components iProcurement, Oracle Application Object Library, Oracle Applications Technology Stack, and Oracle Order Capture. These vulnerabilities have unknown impact and attack vectors.
Multiple unspecified vulnerabilities were discovered in Oracle Database Server components Advanced Replication and Oracle Spatial. These vulnerabilities may allow attacks with unknown impact, including potential SQL injection in the SDO_CATALOG package functions.
A buffer overflow vulnerability in the Advanced Replication component of Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package.
Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1. The impact and attack vectors are unknown, and the issue is tracked as Vuln# JDE01.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 9.2.0.7, 10.1.0.4, and 10.2.0.1. Impact and attack vectors are unknown.
Unspecified vulnerability in the PeopleTools component of Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04. Impact and attack vectors are unknown, identified as Vuln# PSE01.