CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1. The impact and attack vectors are unknown, and the issue is tracked as Vuln# JDE01.
Unspecified vulnerability in the PeopleTools component of Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04. Impact and attack vectors are unknown, identified as Vuln# PSE01.
Multiple unspecified vulnerabilities were discovered in Oracle Database Server components Advanced Replication and Oracle Spatial. These vulnerabilities may allow attacks with unknown impact, including potential SQL injection in the SDO_CATALOG package functions.
A buffer overflow vulnerability in the Advanced Replication component of Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package.
Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications version 11.5.10 in components iProcurement, Oracle Application Object Library, Oracle Applications Technology Stack, and Oracle Order Capture. These vulnerabilities have unknown impact and attack vectors.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, and 9.2.0.7. Impact and attack vectors are unknown.
Unspecified vulnerability in the Oracle Thesaurus Management System component in Oracle E-Business Suite and OPA 4.5.2 Applications. The impact and attack vectors are unknown, and the issue is identified as Vuln# OPA01.
An unspecified vulnerability in Oracle Spatial allows SQL injection via MDSYS.PRVT_IDX functions. The flaw affects Oracle Database versions 8.1.7.4, 9.0.1.5, and 9.2.0.6.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 9.2.0.7, 10.1.0.4, and 10.2.0.1. Impact and attack vectors are unknown.
Unspecified vulnerability in Oracle Database Server versions 9.0.1.5 and 9.2.0.7 in the Oracle Enterprise Manager Intelligent Agent component. Impact and attack vectors are unknown.
An unspecified vulnerability in Oracle Database Server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5 in the Oracle Spatial component. Researchers claim it is SQL injection in MDSYS.SDO_LRS_TRIG_INS, potentially allowing unauthorized data access.
An unspecified vulnerability in Oracle Database Server 9.2.0.6 in the Advanced Replication component. The impact and attack vectors are unknown, and the vulnerability is identified as Vuln# DB02.
Unspecified vulnerability in Oracle Database Server versions 8.1.7.4 and 9.0.1.5 in the Dictionary component. Impact and attack vectors are unknown, identified as Vuln# DB04.
SQL injection vulnerability in category.php of Article Publisher Pro 1.0.1 and earlier. Remote attackers can execute arbitrary SQL commands via the cname parameter.
SQL injection vulnerability in the Your_Account module of PHP-Nuke 7.8 allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. The provenance of this information is unknown; details are obtained solely from third party information.
A direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and earlier versions before 2.25 allows remote attackers to inject PHP code via a semicolon in the name parameter of the systemdoc action. This can lead to arbitrary command execution.
Remote file inclusion vulnerability in PHP Album 0.3.2.3. An attacker can exploit the data_dir parameter in language.php by supplying an FTP URL, leading to arbitrary code execution when register_globals is enabled.
SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
The vulnerability in edit_kategorie.php in Fuju News 1.0 allows a remote attacker to bypass authentication by setting the 'authorized' cookie.
Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the position and id parameters.