CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
The vulnerability in Barracuda Spam Firewall 3.1.10 and earlier allows members of whitelisted domains to send mail to any domain, enabling the device to be used as an open mail relay for spam.
Buffer overflow vulnerability in Sun Java System Web Proxy Server (also known as Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors.
Vulnerability in consoleConnect.jsp in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter.
Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via various parameters, including nChannel, iChannel, iCat, iData, POL_ID, POL_PARENT, POL_CATEGORY, CHA_NAME, CHA_ID, tfm_order, and tfm_orderby.
Multiple buffer overflows in DeleGate before version 8.11.1 may allow attackers to cause a denial of service or execute arbitrary code, possibly due to overflows on arrays.
The addnew script in Argosoft Mail Server Pro 1.8.7.6 allows remote attackers to create arbitrary accounts, even if 'Allow Creation of Accounts From the Web Interface' is disabled, via a direct HTTP POST request.
The vulnerability in index.cgi of E-Cart 2004 version 1.1 and earlier allows a remote attacker to execute arbitrary system commands by injecting shell metacharacters in the art and cat parameters.
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.
SQL injection vulnerability in viewall.php and category.php of paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter in pafiledb.php.
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to upload and potentially execute files outside the directory via the AttachmentsKey parameter to attachment.do, and delete arbitrary files via the select_file parameter to file.do.
MetaCart 2.0 for PayFlow contains multiple SQL injection vulnerabilities in parameters passed to productsByCategory.asp and product.asp scripts. They allow a remote attacker to execute arbitrary SQL commands on the database.
The reportpost action in misc.php of PhotoPost PHP 5.0 RC3 does not limit the logging data sent to the administrator, allowing remote attackers to send large amounts of email to the administrator.
CoolForum 0.8.1 beta and earlier allows remote attackers to manipulate SQL commands via certain requests to alert.php or viewip.php, possibly due to a SQL injection vulnerability.
Buffer overflow vulnerability in HTTPMail component in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the username or password fields in logIn.asp, or the intAuctionID parameter in item.asp.
Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the intProdID parameter in product.asp or strCatalog_NAME parameter in productsByCategory.asp.
MetaCart 2.0 for Paypal contains multiple SQL injection vulnerabilities in parameters: intProdID in product.asp, intCatalogID and strSubCatalogID in productsByCategory.asp, and chkText, strText, chkPrice, intPrice, chkCat, strCat in searchAction.asp. These allow remote attackers to execute arbitrary SQL commands.