CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities were found in OnePlug Solutions OnePlug CMS. Remote attackers can execute arbitrary SQL commands via the Press_Release_ID, Service_ID, and Product_ID parameters in respective ASP files.
A buffer overflow vulnerability exists in the IMAP service of Rockliffe MailSite prior to version 6.1.22.1. This flaw can be exploited remotely, but the exact attack vectors and impact are unknown.
SQL injection vulnerability in linkcategory.php of Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in login.php of TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (the u variable).
Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before version 6.5.5, identified as potential security issues (SPR numbers). One of them (SPR# KSPR699NBP) in the NROUTER component allows a remote attacker to cause a denial of service (high CPU consumption) via a crafted vCal meeting request sent over SMTP.
SQL injection vulnerability in mcl_login.asp of Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. The source of this information is unknown, and details are obtained solely from third party sources.
SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. The source of this information is unknown, and details are obtained solely from third party information.
In Wine 20050930 and other versions, the SETABORTPROC GDI Escape function in WMF files allows arbitrary code execution. This is the same vulnerability as CVE-2005-4560 but in a different codebase.
In PHP 4.3.10 and 4.4.x before 4.4.3 for Windows, the create_named_pipe function in libmysql.c has a stack-based buffer overflow. An attacker can exploit a long arg_host or arg_unix_socket argument, such as a long named pipe variable in the host argument to mysql_connect, to execute arbitrary code.
In Linux kernel versions 2.6.x before 2.6.11 and 2.4.x before 2.4.29, the wan/sdla.c function does not require the CAP_SYS_RAWIO privilege for SDLA firmware upgrades. Although further investigation suggests that exploitation requires root privileges (protected by CAP_NET_ADMIN), the lack of precise privilege distinction may pose a risk.
A PHP remote file inclusion vulnerability in Valdersoft Shopping Cart 3.0 allows attackers to execute arbitrary code via the catalogDocumentRoot parameter. This affects multiple include/templates/categories/ PHP scripts.
SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the usuario_nkads_admin or password_nkads_admin parameters.
In Lizard Cart CMS 1.04, SQL injection vulnerability exists in pages.php and detail.php via the id parameter. This allows a remote attacker to execute arbitrary SQL commands on the database.
SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.
PHP remote file inclusion vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter. This is a different vulnerability than CVE-2006-0076.
A vulnerability in the Intel Graphics Accelerator Driver (ialmnt5.sys) allows an attacker to cause a denial of service (system crash or screen resolution change) by providing a long text field, such as a long window title.
SQL injection vulnerability in auth.php of ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).
SQL injection vulnerability in profile.php of PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. The issue affects version 1.1 and earlier.
A PHP remote file inclusion vulnerability in forum.php of oaBoard 1.0 allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the inc parameter.
A direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field in a new message, which is written to a PHP file.