CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in phpCOIN 1.2.1b and earlier allow remote attackers to execute arbitrary SQL commands via the search engine, the username or email fields in the "forgotten password" feature, or the domain name in a package order.
PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script version 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. It was later reported that version 2.4 is also affected.
Vulnerability in Cisco IOS 12.2T, 12.3, and 12.3T when using Easy VPN Server XAUTH version 6 authentication allows a remote attacker to bypass authentication by sending a malformed packet.
Multiple buffer overflows in Cyrus IMAPd before version 2.2.11 may allow attackers to execute arbitrary code via an off-by-one error in the imapd annotate extension, an off-by-one error in cached header handling, a stack-based buffer overflow in fetchnews, or a stack-based buffer overflow in imapd.
An unknown vulnerability in the Microsoft Jet database engine (msjet40.dll) version 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted .mdb file.
Multiple SQL injection vulnerabilities in index.php of InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the idp, id_ctg, or id_man parameters.
SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the crn parameter in a show action or rn parameter in a show_detail action.
Multiple SQL injection vulnerabilities in Ocean12 Calendar Manager 1.01 allow remote attackers to execute arbitrary SQL commands via the Admin_id field.
SQL injection vulnerability in modules.php in PostNuke 0.760 RC3 allows remote attackers to execute arbitrary SQL statements via the sid parameter. The vendor reports that they could not reproduce the issues for 760 RC3, or for .750.
The vulnerability in ncpfs before version 2.2.6 is that the nwclient.c file does not drop root privileges before executing utilities using the NetWare client functions. This allows local users to escalate their privileges.
SQL injection vulnerability in ad_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner_id parameter.
SQL injection vulnerability in PHP scripts of phpMyFamily 1.4.0 allows remote attackers to execute arbitrary SQL commands via the person parameter in people.php or the Login field.
Multiple SQL injection vulnerabilities were found in Valdersoft Shopping Cart 3.0. An attacker can remotely execute arbitrary SQL commands by manipulating parameters in various PHP scripts.
A vulnerability in Dnsmasq before version 2.21 allows remote attackers to poison the DNS cache by sending answers to queries that were not made by Dnsmasq.
The vulnerability in inc_login_check.asp in ACS Blog versions 0.8 through 1.1.3 allows remote attackers to gain administrator privileges by manipulating the 'in' value in a cookie.
Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information.
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the 'Server Message Block Vulnerability,' and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the 'DHTML Method Heap Memory Corruption Vulnerability'.
The Hyperlink Object Library in Windows 98, 2000, XP, and Server 2003 contains a buffer overflow that can be exploited by a remote attacker to execute arbitrary code via a crafted link.
Multiple vulnerabilities in fliccd, installed setuid root as part of the kdeedu Kstars support for INDI in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.