CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability exists in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier when a Unicode string is converted to a narrow string. This flaw may allow a remote attacker to cause an unknown impact.
A vulnerability in config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.
In Joomla! 1.0.7 and earlier, multiple SQL injection vulnerabilities exist in the Admin functionality. They allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.
Buffer overflow vulnerability in the IsComponentInstalled method of Internet Explorer 6.0 on Windows 2000 before SP4 and Windows XP before SP1. A remote attacker can execute arbitrary code via JavaScript calling this method with a long first argument.
In SMartBlog (SMBlog) 1.2, the index.php file contains a remote file inclusion vulnerability. An attacker can use the pg parameter or a query string without a parameter to include and execute arbitrary PHP code from an external source.
JFacets before version 0.2 allows remote attackers to gain privileges of any account by sending a GET request with a modified account profile ID.
The c-client library in PHP before 4.4.4 and 5.x before 5.1.5 does not check safe_mode or open_basedir settings. In applications that accept user-controlled input for the mailbox argument of the imap_open function, this allows remote attackers to access an IMAP stream data structure and perform unauthorized IMAP actions.
SQL injection vulnerability in poems.php of DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.
In Joomla! 1.0.7, the feedcreator.class.php (syndication component) allows a remote attacker to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.
SQL injection vulnerability in forumlib.php in Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
SQL injection vulnerability in MgrLogin.asp of Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. The details are obtained solely from third party information.
WordPress 1.5.2 (and possibly earlier versions before 2.0) contains an SQL injection vulnerability in the User-Agent field of the HTTP header when posting a comment. A remote attacker can exploit this to execute arbitrary SQL commands on the database.
Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the newsid parameter in newsdetailsview.asp and the password parameter in login.asp.
Multiple SQL injection vulnerabilities exist in sendcard.php in sendcard before version 3.3.0. Remote attackers can execute arbitrary SQL commands via unspecified parameters.
Multiple SQL injection vulnerabilities in N8cms versions 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the dir and page_id parameters to index.php.
The NETGEAR WGT624 wireless DSL router has a default account with username "Gearguy" and password "Geardog", allowing remote attackers to modify the device configuration. Note that not all WGT624 routers may be affected.
PHP remote file inclusion vulnerability in index.php of Top sites de PixelArtKingdom allows attackers to include and execute arbitrary files via the 'page' parameter.
Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before version 0.9.96. Impact and attack vectors are unknown.
A PHP remote file inclusion vulnerability in index.php of one or more ActiveCampaign products, likely SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.
SQL injection vulnerability in topics.php of phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.