CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the itemID parameter to login.php and memo.php, and via itemgr, brandID, and album parameters to index.php. Invalid SQL queries also result in full path disclosure.
In SPIP 1.8.3, the file spip_login.php3 contains a PHP remote file inclusion vulnerability. An attacker can exploit the url parameter to execute arbitrary PHP code from an external source.
A heap-based buffer overflow in zgv before version 5.8 and xzgv before version 0.8 may allow user-assisted attackers to execute arbitrary code via a crafted JPEG image with more than 3 output components, such as CMYK or YCCK color space, which causes less memory to be allocated than required.
SQL injection vulnerability in member.php of Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page request to index.php.
A remote file inclusion vulnerability in lire.php of Sire 2.0 nws allows attackers to execute arbitrary PHP code by supplying a malicious URL in the rub parameter.
Multiple SQL injection vulnerabilities exist in the modules.php file of APT-webshop-system versions 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT. Remote attackers can execute arbitrary SQL commands via the group, seite, and id parameters, likely in the artikel functionality. Additionally, invalid SQL queries may lead to path disclosure.
An unspecified vulnerability in the su program in HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.
SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name field.
SQuery 4.5 and earlier contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the libpath parameter in scripts in the lib directory to execute arbitrary PHP code.
The vulnerability in NOD32 2.5 GUI (nod32.exe) causes it to run with SYSTEM privileges during scheduled on-demand scans, allowing local users to execute arbitrary code via unspecified attack vectors.
The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", allowing remote attackers to execute arbitrary code on a CTC workstation.
Control cards in Cisco Optical Networking System (ONS) 15000 series nodes before April 5, 2006 are vulnerable to a DoS attack by sending an invalid response instead of the expected final ACK. The attack can cause memory exhaustion and potentially card reset.
SQL injection vulnerability in slides.php of Crafty Syntax Image Gallery (CSIG) 3.1g and earlier allows remote authenticated users to execute arbitrary SQL commands via the limitquery_s parameter when the $projectid variable is less than 1.
The vulnerability in newimage.php in Crafty Syntax Image Gallery (CSIG) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code by sending a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.
SQL injection vulnerability in forum.php of Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.
A vulnerability in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php. The flaw exists in the frontpage option.
A buffer overflow vulnerability in the xine_list_delete_current function of libxine 1.14 and earlier, distributed as xine-lib 1.1.1 and earlier, allows remote attackers to execute arbitrary code via a crafted MPEG stream.
A direct static code injection vulnerability in ticker.db.php of Chucky A. Ivey N.T. 1.1.0 allows remote administrators to inject arbitrary PHP code into the config file. This code is then included by other N.T. scripts, leading to arbitrary code execution on the server.
Multiple format string vulnerabilities in the logging code of Clam AntiVirus (ClamAV) before version 0.88.1 might allow remote attackers to execute arbitrary code. However, as of April 2006, it is unclear whether this is a real vulnerability, as there is evidence that arguments are properly sanitized.
A vulnerability in OpenVPN 2.0 through 2.0.5 allows a remote malicious server to execute arbitrary code on the client by setting the LD_PRELOAD environment variable via the setenv directive.