CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the username or password parameters to admin_login.asp, or the searchstring and possibly ID parameters to default.asp.
The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by sniffing the connection on TCP port 51100 and replaying the authentication information or obtaining and replaying the PCZQX02 authentication cookie from the browser.
A vulnerability in the sendfile system call in FreeBSD allows portions of kernel memory to be transferred if a file is truncated while being sent, potentially enabling a remote attacker to obtain sensitive information.
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
Vulnerability in Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 with Active Directory allows local users to bypass group policies restricting access to hidden drives. The attack can be performed using the browse feature in Office 10 applications such as Word or Excel, or by using a flash drive.
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
SQL injection vulnerability in the Update_Events function in events_functions.asp in MaxWebPortal 1.33 and earlier allows remote attackers to execute arbitrary SQL commands via the EVENT_ID parameter, as demonstrated using events.asp.
The custom avatar uploading feature (uploader.php) in XOOPS 2.0.9.2 and earlier does not filter file extensions, allowing remote attackers to upload arbitrary PHP scripts.
Buffer overflow vulnerability in discdb.c of grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected.
AWStats 4.0 and 6.2 contain a vulnerability in the awstats.pl script that allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters into the config parameter.
SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the 'change user' field.
The text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
A buffer overflow vulnerability in Convert-UUlib (Convert::UUlib) before version 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.
Multiple SQL injection vulnerabilities in default.asp in StorePortal 2.63 allow remote attackers to execute arbitrary SQL commands via the language, bpic, idcategory, content, keyword, or idproduct parameter.
SQL injection vulnerability in printthread.php in UBB.Threads allows remote attackers to execute arbitrary SQL commands via the main parameter.
Multiple SQL injection vulnerabilities in OneWorldStore allow remote attackers to execute arbitrary SQL commands via the idProduct parameter to (1) owAddItem.asp or (2) owProductDetail.asp, (3) idCategory parameter to owListProduct.asp, or (4) bSpecials parameter to owListProduct.asp.
SQL injection vulnerability in the datenbank module for phpBB, present in mod.php, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unknown vulnerability in DameWare NT Utilities 4.8 and earlier, and Mini Remote Control 4.8 and earlier, allows local users to gain additional rights.
SQL injection vulnerability in sdating.php of aeDating 3.2 allows remote attackers to execute arbitrary SQL commands via the event parameter.
Unknown vulnerability in sCssBoard 1.11 and earlier, related to an exploit on the Profile page. Details of the flaw are unknown.