CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter.
TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password via a direct request to the _dat/login file.
Multiple SQL injection vulnerabilities in AzDGDatingPlatinum 1.1.0 allow remote attackers to execute arbitrary SQL commands via the id parameter in view.php or the from parameter in members/index.php.
Vulnerability in Access_user Class before version 1.75 allows local users to gain access as other users via the password 'new'.
Vulnerability in the Meilad File upload script (up.php) mod for phpBB 2.0.x does not properly limit the types of files that can be uploaded, allowing remote authenticated users to execute arbitrary commands by uploading PHP files and then directly requesting them from the uploads directory.
SQL injection vulnerability in main.asp of Ocean12 Membership Manager Pro 1.x allows remote attackers to execute arbitrary SQL commands via the UserID parameter.
Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the catid, SortDir, Sortby parameters in default.asp, itemID in ItemInfo.asp, and Email field in sendpassword.asp.
Multiple buffer overflows in Pavuk before version 0.9.32 have unknown attack vectors and impact.
The vulnerability in the load_elf_library function of the Linux kernel before version 2.6.11.6 allows local users to cause a system crash (kernel panic) via a crafted ELF library or executable, leading to a free of an invalid pointer.
The vulnerability in Bay Technical Associates RPC-3 Telnet Host 3.05 allows a remote attacker to bypass authentication by pressing the Escape and Enter keys at the login prompt.
Format string vulnerability in gprostats for GProFTPD before version 8.1.9 may allow a remote attacker to execute arbitrary code by transferring a file with a crafted filename that causes format string specifiers to be inserted into the ProFTPD transfer log.
PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code.
SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the search, forgot password, or new package ordering fields.
Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly other SMTP commands.
Multiple SQL injection vulnerabilities in exoops allow remote attackers to execute arbitrary SQL commands via the viewcat parameter in index.php or the artid parameter in the viewarticle action for index.php.
A vulnerability in the Bluetooth stack of the Linux kernel (versions 2.4.6–2.4.30-rc1 and 2.6–2.6.11.5) allows a local user to gain privileges by calling the socket or socketpair function with a negative protocol value.
Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value.
Unknown vulnerabilities in deplate before version 0.7.2, possibly involving elements.rb, have unknown impact.
Eval injection vulnerability in Double Choco Latte before version 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in functions.inc.php or main.php.
Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrary code via a long CF_CHARSET_PATH environment variable.