CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP Scripts Mall Resume Clone Script is vulnerable to SQL Injection via the 'username' parameter in forget.php.
PHP Scripts Mall Professional Service Script is vulnerable to CSRF via admin/general_settingupd.php, allowing modification of settings in the user panel.
PHP Scripts Mall Professional Service Script is vulnerable to SQL injection via the id parameter in admin/review.php.
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached.
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incompatibility with libwebp versions 0.5.0 and later that use a different structure type.
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
PHP Scripts Mall Responsive Realestate Script has a CSRF vulnerability in the admin/general section.
PHP Scripts Mall Car Rental Script is vulnerable to SQL Injection via the carid parameter in admin/carlistedit.php.
PHP Scripts Mall Car Rental Script has a CSRF vulnerability via admin/sitesettings.php.
FS Lynda Clone has a CSRF vulnerability via the user/edit_profile endpoint, allowing content to be added to the user panel.
Version 6.0.4 of Dolibarr ERP/CRM contains an SQL injection vulnerability in fourn/index.php that allows remote attackers to execute arbitrary SQL commands via the socid parameter.
An SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 in adherents/subscription/info.php allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, allowing remote attackers to obtain sensitive information.
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Readymade Job Site Script is vulnerable to SQL Injection via the location_name array parameter in the /job URI.
Readymade Job Site Script has a CSRF vulnerability via the /job URI.
Readymade Video Sharing Script is vulnerable to SQL Injection via the chnlid parameter in viewsubs.php or the search parameter in search_video.php.
Readymade Video Sharing Script has a CSRF vulnerability in user-profile-edit.php.
In the cgi-bin/write.cgi script in Anti-Web up to version 3.8.7, used in various devices, remote authenticated users can execute arbitrary OS commands via crafted multipart/form-data content.
In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS