CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in blog.php.
Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php.
A vulnerability in the Stack Group Bidding Protocol (SGBP) support in Cisco IOS versions 12.0 through 12.4 allows a remote attacker on the local network to cause a denial of service (device hang and network traffic loss) by sending a crafted UDP packet to port 9900.
A buffer overflow vulnerability exists in multiple F-Secure Anti-Virus products for Windows and Linux when processing crafted ZIP archives. This allows remote attackers to execute arbitrary code on the affected system.
The RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 is vulnerable to a denial of service attack via a malformed query string containing special characters like '|'. This causes high CPU consumption and service crash.
SQL injection vulnerability in HITSENSER Data Mart Server (versions BS, BS-S, BS-M, BS-L, and EX) allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
A buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code when the publisher's name link is clicked via a long publisher URI in a torrent file.
Etomite CMS 0.6 (and earlier) downloaded from the vendor site after January 10, 2006 contains a backdoor in manager/includes/todo.inc.php. Remote attackers can execute arbitrary commands via the 'cij' parameter.
A vulnerability in crawl before version 4.0.0 allows local users to gain privileges by unsafely calling programs when saving and loading games.
A heap-based buffer overflow in the encodeURI and decodeURI functions of the kjs JavaScript interpreter in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted UTF-8 encoded URI.
SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in login.php.
SQL injection vulnerability in login.php of aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
BlogPHP 1.0 contains an SQL injection vulnerability in index.php when magic_quotes_gpc is disabled. An attacker can send a crafted query via the username parameter in a login action, allowing arbitrary SQL commands and authentication bypass.
A buffer overflow in the YGPPicFinder.DLL ActiveX control in the AOL You've Got Pictures (YGP) Picture Finder Tool, used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.
PDFdirectory before version 1.0 stores sensitive data in plaintext, allowing remote attackers to obtain arbitrary users' passwords via direct database queries, possibly through SQL injection vulnerabilities.
SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.
Multiple SQL injection vulnerabilities were found in PDFdirectory before version 1.0 in files util.php, userpref.php, user.php, uploadfrm.php, title.php, team.php, stats.php, page.php, org.php, member.php, index.php, group.php, and anniv.php. These allow remote attackers to execute arbitrary SQL commands.
An integer overflow in the IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE occurs while scanning for wireless networks. Remote attackers can exploit this by broadcasting crafted beacon or probe response frames to execute arbitrary code.
A buffer overflow vulnerability in Dual DHCP DNS Server 1.0 exists in the DHCP options field. Remote attackers can exploit this to cause a denial of service (application crash) and potentially execute arbitrary code.
Clipcomm CPW-100E and CP-100E devices with vulnerable firmware allow remote unauthorized access via the debug service on TCP port 60023.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS