CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the Direction parameter in computers/default.asp and the SearchText, StatusFilter, and computerFilter parameters in reports/default.asp.
SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
Multiple SQL injection vulnerabilities in the Info-DB module (info_db.php) in Woltlab Burning Board 2.7 and earlier allow remote attackers to execute arbitrary SQL commands and possibly upload files via the fileid and subkatid parameters.
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands via the name parameter in register.php, the email parameter in lostpassword.php, the year parameter in calendar.php, and the cid parameter to index.php. The index.php/cid vector also affects version 6.11.
Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL commands via (1) the buddy parameter in buddy.php, (2) the u2uid parameter in u2u.php, and (3) an invalid theme file in the themes action to ctrtools.php.
SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
SQL injection vulnerability in Saphp Lesson (possibly versions 1.1 and 2.0) allows remote attackers to execute arbitrary SQL commands via the forumid parameter in showcat.php and add.php.
SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
The _httpsrequest function in Snoopy 1.2, used in products such as WordPress, MagpieRSS, Ampache, and Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL. The issue is due to improper handling of these characters by the fetch function.
SQL injection vulnerability in chat.php of MWChat 6.8. A remote attacker can execute arbitrary SQL commands via the username parameter.
Vulnerability in Mantis before version 0.19.3 causes the User ID to be cached longer than necessary. The impact and attack vectors are unknown.
SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Vulnerability in Data ONTAP 7.0 and earlier allows an attacker to bypass iSCSI authentication by using a modified client that skips the Security (Start) mode required by the Login Negotiation protocol and directly enters Operational mode without proving identity.
PHP remote file inclusion vulnerability in common.php in PunBB versions 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.
The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.
PHP remote file inclusion vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.
Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the SLIMP3 and AgentX dissector.
Multiple stack-based buffer overflows in ZipGenius versions 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via a crafted ZIP archive with a long filename, a long original name in UUE/XXE/MIM files, or an ACE archive with a long filename.