CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Uphotogallery involves storing the database file in the web document root, allowing remote attackers to directly request uphotogallery.mdb and obtain sensitive information.
The media manager in Serendipity before version 0.8 allows remote attackers to upload and execute arbitrary .php or .shtml files.
Unknown vulnerability in the serendipity_config_local.inc.php file in Serendipity before version 0.8. The impact details are unknown.
Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to perform administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
SQL injection vulnerability in search.php in PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
A buffer overflow vulnerability in HP Radia Notify Daemon 3.1.0.0 (formerly Novadigm) and versions 2.x, 3.x, and 4.x allows remote attackers to execute arbitrary code via a long file extension.
A directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter.
Open WebMail (OWM) before version 2.51 dated 2005-04-30 allows remote authenticated users to execute arbitrary commands by including shell metacharacters in a filename.
Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the id parameter to admin.php or cat parameter to view.php.
Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the q or p parameters.
Claroline versions 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, contain multiple PHP remote file inclusion vulnerabilities. These flaws allow remote attackers to execute arbitrary PHP code on the server via unknown vectors.
In Claroline 1.5.3 through 1.6 Release Candidate 1 and possibly Dokeos, the scripts document.php and insertMyDoc.php contain directory traversal vulnerabilities. This allows remote project administrators to upload arbitrary files.
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
A vulnerability in SitePanel 2.6.1 and earlier allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment to a trouble ticket.
Vulnerability in Serendipity before version 0.8 allows Chief users to hide plugins installed by other users.
SQL injection vulnerability in verify.asp of Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter.
SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the 'change user' field.
A double free vulnerability in gtk2 before version 2.2.4 allows remote attackers to cause a denial of service (crash) via a crafted BMP image.
A buffer overflow in the mt_do_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path.
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via the email, url, orderby, min, show, and ratenum parameters in various functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS