CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Java Net component of Oracle Database Server and Application Server. May lead to unknown security impacts.
Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2 (9.0.4.2) in the Reorganize Objects & Convert Tablespace component. May lead to unknown security impacts.
Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10. These flaws have unknown impact and attack vectors, identified as REP01 and REP02.
Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 affecting Data Pump, Oracle Text, Streams Apply, Streams Capture, and Streams Subcomponent. One (DB05) involves SQL injection in DBMS_METADATA_UTIL, DBMS_METADATA_INT, and DBMS_METADATA packages.
Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2. The flaw has unknown impact and attack vectors, identified as Oracle Vuln# OHS02.
Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal versions 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2. Attackers may exploit unknown vectors leading to unspecified impacts.
Multiple unspecified vulnerabilities were identified in Oracle E-Business Suite and Applications 11.5.9 within the CRM Technical Foundation, iProcurement, and Oracle Application Object Library components. Their impact and attack vectors are unknown.
Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2. May lead to unknown security impacts.
Multiple unspecified vulnerabilities were found in Oracle Database versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 in the Net Listener and Network Communications (RPC) components. The impact and attack vectors are not detailed.
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 affect Data Pump, Net Listener, and Oracle Text components. One (DB06) is SQL injection in DBMS_DATAPUMP functions, potentially allowing unauthorized database access.
SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the year, month, and day parameters.
An unspecified vulnerability in context.py in the Albatross web application toolkit before version 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the handling of submitted form fields.
SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter ($tmpCategory variable), enabling credential theft and file uploads.
The vulnerability in Check Point VPN-1 SecureClient is due to an unquoted Windows search path. A local user can place a malicious "program.exe" file in the C:\ directory, which will be executed instead of the intended Sr_GUI.exe program.
Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the 'month' parameter in an archives view operation and possibly certain other parameters in unspecified scripts.
The WP-Stats 2.0 plugin for WordPress contains an SQL injection vulnerability in wp-stats.php. Remote attackers can execute arbitrary SQL commands via the 'author' parameter.
SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter in pictures.php.
In microBlog 2.0 RC-10, the index.php file contains an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the month and year parameters.
The RBAC functionality in grsecurity before version 2.1.8 improperly handles when the admin role creates a service and then exits the shell without unauthenticating, causing the service to be restarted with the admin role still active.
SQL injection vulnerability in the Admin Panel of Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the username or password parameters in index.asp.