CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in ringmaker.php in Orca Ringmaker 2.3c and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter.
SQL injection vulnerability in survey.php in ilyav Survey System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the SURVEY_ID parameter.
The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values, which slows down the hash table lookups.
WebCalendar 1.0.1 contains multiple SQL injection vulnerabilities in the startid, template, and other parameters, allowing remote attackers to execute arbitrary SQL commands.
Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors.
SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
PHP file include vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to include arbitrary local files via the __f parameter.
SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL commands via the msg parameter.
SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter.
SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter in index.php and download.php, or the ckode parameter in baca.php.
Kadu versions 0.4.2 and 0.5.0pre allow remote attackers to cause a denial of service (crash or generated traffic) via a malformed message, possibly with incomplete information.
SQL injection vulnerability in index.php in Entergal MX 2.0 allows remote attackers to execute arbitrary SQL commands via the idcat parameter in a showcat action and the action parameter.
Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earlier allow remote attackers to execute arbitrary SQL commands via the catid, perpage, ascdesc, and orderlinks parameters in a displaycat action in index.php, and the id parameter in comments.php and memberlist.php.
A buffer overflow vulnerability in Symantec pcAnywhere 11.0.1, 11.5.1, and all other 32-bit versions allows remote attackers to cause a denial of service (application crash) via unknown attack vectors.
Multiple SQL injection vulnerabilities in ilyav FAQ System 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the FAQ_ID and action parameters in viewFAQ.php, and the CATEGORY_ID parameter in index.php.
SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter.
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the 'category' and 'type' parameters to viewcat.php, or certain search parameters. The affected version is reported as 1.0.
Multiple SQL injection vulnerabilities were found in index.php of DMANews versions 0.904 and 0.910. An attacker can remotely execute arbitrary SQL commands via the id parameter (in comments action) and the sortorder and display_num parameters (in news_list action).
SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.
SQL injection vulnerability in Softbiz B2B Trading Marketplace Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter in (1) selloffers.php, (2) buyoffers.php, (3) products.php, or (4) profiles.php.