CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Open WebMail (OWM) before version 2.51 dated 2005-04-30 allows remote authenticated users to execute arbitrary commands by including shell metacharacters in a filename.
Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the id parameter to admin.php or cat parameter to view.php.
The media manager in Serendipity before version 0.8 allows remote attackers to upload and execute arbitrary .php or .shtml files.
Unknown vulnerability in the serendipity_config_local.inc.php file in Serendipity before version 0.8. The impact details are unknown.
Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to perform administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
SQL injection vulnerability in search.php in PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the username or password parameters to admin_login.asp, or the searchstring and possibly ID parameters to default.asp.
Vulnerability in the OHS component versions 1.0.2 through 10.x, when UseWebcacheIP is disabled, allows a remote attacker to bypass HTTP Server mod_access restrictions by sending a request to the webcache TCP port 7778.
A buffer overflow vulnerability in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.
Unknown vulnerability in the function used to validate path-names for uploading media in Serendipity before version 0.8. The impact details are unknown.
PHP remote file inclusion vulnerability in main.php of SitePanel 2.6.1 and earlier allows remote attackers to execute arbitrary PHP code via the p parameter.
SQL injection vulnerability in the notes module for phpBB, in posting_notes.php, allows remote attackers to execute arbitrary SQL commands via the p parameter (used in the $post_id variable) and other attack vectors.
Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
Multiple unknown vulnerabilities in OpenView Network Node Manager (OV NNM) versions 6.2, 6.4, 7.01, and 7.50 allow attackers to cause a denial of service or execute arbitrary code.
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL commands via parameters in various ASP scripts.
Vulnerability in Serendipity before version 0.8 allows Chief users to hide plugins installed by other users.
A vulnerability in SitePanel 2.6.1 and earlier allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment to a trouble ticket.
SQL injection vulnerability in verify.asp of Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter.