CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unspecified vulnerabilities were found in MyBB before version 1.0.2 in files admin/moderate.php, admin/themes.php, inc/functions.php, inc/functions_upload.php, printthread.php, and usercp.php. These vulnerabilities are likely related to SQL injection, with unspecified impact and attack vectors.
The MyBB update distribution to version 1.0.2 omits or includes older versions of critical files, allowing SQL injection via attachment name in inc/functions_upload.php and possibly other attacks related to threadmode in usercp.php.
Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.
SQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the livestock_id parameter in showInfo.php and the tank_id parameter, possibly in livestock.php.
A format string vulnerability in the error-reporting feature of the mysqli extension in PHP 5.1.0 and 5.1.1 may allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
SQL injection vulnerability in news.asp of Mini-Nuke CMS System version 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via the 'date' parameter in cal.php, which is included by index.php.
An unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (system panic) via unspecified vectors, possibly involving functions from the mm driver.
SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.
A buffer overflow vulnerability in eStara Softphone versions 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code by sending a crafted SIP packet with a long attribute ('a') field in the SDP data over UDP port 5060.
Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the id parameter in goto.asp or the password parameter in includeloginuser.asp.
Cisco CS-MARS before version 4.1.3 contains an undocumented administrative account with a default password. A local user can exploit the expert command to gain elevated privileges.
A vulnerability in login.php of ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".
A buffer overflow vulnerability was found in certain functions in src/fileio.c and src/unix/fileio.c in xmame before January 11, 2006. Providing a long -lang, -ctrlr, -pb, or -rec argument on many operating systems, or a long -jdev argument on Ubuntu Linux, may allow a local user to gain privileges.
The addresses.php3 script in MyPhPim 01.05 does not restrict uploaded files, allowing remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.
Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by invoking /usr/bin/script with a long command line argument or setting the -c option of /etc/nu to the name of a file containing a long line.
SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the cal_id parameter in calendar.php3 and the password field on the login page.
The vulnerability in phgstats.inc.php in phgstats before version 0.5.1 allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable when register_globals is enabled.
SQL injection vulnerability in the search module of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter in modules/Search/index.php.
The vulnerability in Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the hidden Norton Protected Recycle Bin (NProtect) directory. This directory is hidden from the FindFirst and FindNext Windows APIs, allowing remote attackers to hide arbitrary files from virus scanners and other security products.