CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.
SQL injection vulnerability in index.php of Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
SQL injection vulnerability in admin.php of MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.
The __group_complete_signal function in the RCU signal handling (signal.c) in Linux kernel 2.6.16 and possibly other versions has unknown impact and attack vectors related to improper use of BUG_ON.
A PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to multiple scripts in the admin folder. This can lead to full server compromise.
Multiple SQL injection vulnerabilities exist in form.php of JBook 1.4 via the nom and mail parameters. Remote attackers can execute arbitrary SQL commands.
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. This issue also affects version 2.01.
Multiple SQL injection vulnerabilities in MvBlog before version 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
A buffer overflow in URLMON.DLL of Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS).
A vulnerability in Microsoft Internet Explorer 5.01 through 6 involves incorrect return of IOleClientSite information when dynamically creating an embedded object. This can cause the object to run in the wrong security context or zone, allowing remote attackers to execute arbitrary code.
A vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via specially crafted HTML elements with a certain tag, leading to memory corruption.
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code by instantiating the Mdt2gddr.dll, Mdt2dd.dll, and Mdt2gddo.dll COM objects as ActiveX controls, leading to memory corruption.
An unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.
A CRLF injection vulnerability in index.php of Christoph Roeder's phpMyForum 4.0 allows remote attackers to inject HTTP headers via hex-encoded CRLF sequences in the type parameter.
In DNGuestbook 2.0, the admin.php file contains an SQL injection vulnerability. An attacker can send crafted requests via the email and id parameters, allowing arbitrary SQL commands to be executed.
SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the user_name parameter in unsubscribe.php.
The vulnerability in Buy.php of Aweb Scripts Seller uses predictable cookies for authentication based on time and script number. This allows a remote attacker to bypass authentication.
SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier. Remote attackers can execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the itemID parameter to login.php and memo.php, and via itemgr, brandID, and album parameters to index.php. Invalid SQL queries also result in full path disclosure.