CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in Teamwork 3 before alpha 1.7, related to a menu security bug. Impact and attack vectors are unknown.
An unspecified vulnerability in Kerio WinRoute Firewall before version 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.
A buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.
Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.
SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item parameter. The provenance of this issue is unknown; the details were obtained solely from third party sources.
SQL injection vulnerability in RunScript.asp of iCMS allows remote attackers to execute arbitrary SQL commands via the Event_ID parameter.
SQL injection vulnerability in index.php of ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.
SQL injection vulnerability in Page.asp of Baseline CMS version 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the sort_mode, post_id, and blog_id parameters, which are not properly sanitized by the convert_sortmode function in kernel/BitDb.php.
SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the nodeID, pageID, ID, and parentid parameters in index.cfm, and the documentFormatId parameter in document/docWindow.cfm.
SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.
SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. The provenance of this information is unknown; the details are obtained solely from third party information.
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to '.dll' followed by arguments such as '~0' through '~9', which causes ntdll.dll to produce a return value that is not correctly handled by IIS, potentially leading to code execution rather than just a denial of service as originally believed.
In toendaCMS 0.6.2.1, configured to use a SQL database, a SQL injection vulnerability exists in index.php. Remote attackers can execute arbitrary SQL commands via the id parameter.
An unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via unknown attack vectors.
The vulnerability in the ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to bypass security controls.
Vulnerability in the announcement.pl script of Blackboard Learning and Community Portal System in Academic Suite versions 6.3.1.424, 6.2.3.23, and earlier before version 6 allows a remote attacker to gain administrator privileges by setting the context parameter to 'admin'.
The vulnerability in Adobe ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, allowing local developers to obtain the hash and gain privileges.
The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to bypass authentication and gain privileges as other users via a modified user_id parameter and a '/' in the encoded_pw parameter.
SQL injection vulnerability in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter in index.php, which modifies the underlying $_SERVER variable.