CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in HP-UX versions B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.
An unspecified vulnerability in Oracle PL/SQL (PLSQL) allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures. This affects multiple versions of Database Server, Application Server, E-Business Suite, and Collaboration Suite.
An unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.
BEA WebLogic Portal 8.1 through SP3 stores the RDBMS Authentication provider password in cleartext in the config.xml file, allowing attackers to escalate privileges.
In BEA WebLogic Server and WebLogic Express versions 8.1 through SP4, when configuration auditing is enabled and a password change occurs, old and new passwords are stored in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), allowing remote attackers to hijack sessions and potentially gain administrative privileges.
Multiple SQL injection vulnerabilities were found in index.php in NewsPHP. Remote attackers can execute arbitrary SQL commands via the discuss, tim, id, last, and limit parameters.
SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.
SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.
Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.
A vulnerability in the rsh utility in Sun Grid Engine (SGE) before version 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.
SQL injection vulnerability in Zoph before version 0.5pre1 allows remote attackers to execute arbitrary SQL commands.
Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the monthy parameter in index.php and the login parameter in admin/index.php.
In the PPTP NAT helper module of the Linux kernel 2.6.14 and other versions, the ip_nat_pptp function in netfilter/ip_nat_helper_pptp.c allows remote attackers to cause a denial of service (memory corruption or crash) by sending a PPTP_IN_CALL_REQUEST packet that leads to a null pointer being used in an offset calculation.
PowerPortal versions 1.1 beta through 1.3 are vulnerable to SQL injection in the search parameter of index.php and search.php. Remote attackers can execute arbitrary SQL commands.
BlogPHP version 1.0 contains an SQL injection vulnerability in config.php. An attacker can remotely execute arbitrary SQL commands via the blogphp_username or blogphp_password cookie parameters.
The ACT P202S IP Phone with firmware 1.1.21 exposes multiple undocumented ports, allowing remote attackers to access sensitive data, reflect network traffic, and gain unauthorized login access.
A buffer overflow vulnerability in CounterPath eyeBeam SIP Softphone allows a remote attacker to cause a device crash or hang by sending specially crafted SIP INVITE commands with a long header field name.
A vulnerability in Cisco CallManager allows remote attackers to cause a denial of service via a large number of TCP connections to port 2000 (CPU/memory exhaustion) or ports 2001, 2002, 7727 (filling the Windows Service Manager communication queue).
The 802.11 wireless client in Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when establishing an ad hoc (peer-to-peer) association or when such an association is established by another station. This allows a remote attacker to set up unexpected wireless communication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS