CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In eggblog 2.0, the search.php file mishandles the q parameter, allowing an attacker to disclose the full server path. This issue may be related to an SQL injection vulnerability.
The slsmgr and slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, allowing local users to gain privileges.
The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.
The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors. This vulnerability could lead to unauthorized access to accounts and data.
A vulnerability in scponlyc (scponly 4.1 and earlier) allows a local user to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to alter expected function calls in the setuid application.
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via the setLang parameter in index.php and unspecified search module parameters.
Multiple SQL injection vulnerabilities were found in Mantis 1.0.0rc3 and earlier in the manage user page. Remote attackers can execute arbitrary SQL commands via the 'prefix' and 'sort' parameters in manage_user_page.php and the 'sort' parameter in view_all_set.php.
A vulnerability in Mantis before version 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter in bug_file_add.php, bug_report.php, bug_report_advanced_page.php, and proj_doc_add_page.php.
SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.
An argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via getopt-style argument specifications that are not filtered.
A buffer overflow vulnerability in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.
WebDB 1.1 and earlier contain an SQL injection vulnerability via unspecified search parameters (possibly Search0). The vendor disputes this, stating the code was added for a specific client and has been removed, with all clients receiving updates automatically.
SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. The provenance of this information is unknown; details are obtained solely from third party information.
An unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) allows local users to gain privileges by placing a malicious "program.exe" file in the C: folder, which is executed by naPrdMgr.exe when it attempts to run EntVUtil.EXE.
SQL injection vulnerability in phpBB 2 before version 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type parameter.
A vulnerability in the khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.
SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the show and type parameters. The provenance of this information is unknown, although it was later rediscovered.
Buffer overflow vulnerability in the Network Block Device (nbd) server versions 2.7.5 and earlier, and 2.8.0 through 2.8.2. A remote attacker can send an oversized request that is written past the end of the buffer because nbd does not account for memory taken by the reply header, allowing arbitrary code execution.
Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the menuid parameter in index.php and guestbook.php, and the forumid and reporeid_print parameters in print.php.