CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Geeklog before 1.3.11 allows remote attackers to execute arbitrary SQL commands via user comments for an article.
A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.
SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote attackers to execute arbitrary SQL commands via the ticket variable.
PHP remote file inclusion vulnerability in EasyPHPCalendar 6.1.5 and earlier allows remote attackers to execute arbitrary code via the serverPath parameter.
SQL injection vulnerability in Covide Groupware-CRM allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.
SQL injection vulnerability in the loginUser function of the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.
Eval injection vulnerability in PEAR XML_RPC up to version 1.3.0 and PHPXMLRPC up to version 1.1 allows remote attackers to execute arbitrary PHP code via a crafted XML file that is not properly sanitized before being used in an eval statement. This flaw affects many popular CMS and applications such as WordPress, Drupal, Serendipity, eGroupware, TikiWiki, and others.
The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors.
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier. Remote attackers can execute arbitrary SQL commands via unfiltered input in the HTTP_RAW_POST_DATA variable, which stores data in an XML file.
A vulnerability in Cisco IOS versions 12.2T through 12.4 allows remote attackers to bypass AAA RADIUS authentication, if the fallback method is set to none, via a long username.
Vulnerability in login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.
SQL injection vulnerability in verify.asp in EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0 allows remote attackers to execute arbitrary SQL commands via the T1 or T2 parameters.
Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp.
Unknown vulnerability in Remote Agent for Windows Servers (RAWS) in VERITAS Backup Exec 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for NetWare, allows remote attackers to gain privileges by copying the handle for the server.
In Solaris 8, 9, and 10, the runtime linker (ld.so) trusts the LD_AUDIT environment variable in setuid or setgid programs, allowing local users to gain privileges by modifying LD_AUDIT to reference malicious code or using a long value for LD_AUDIT.
Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.
SQL injection vulnerability in comment_post.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter.
SQL injection vulnerability in article.asp in unknown versions of aspnuke allows remote attackers to execute arbitrary SQL commands via the articleid parameter.
A buffer overflow vulnerability in the VERITAS Backup Exec Web Administration Console (BEWAC) versions 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code.