CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter in addons/import_export/pages/index.inc.php and pages/community.inc.php.
In SquirrelMail 1.4.6 and earlier, with register_globals enabled and magic_quotes_gpc disabled, a remote attacker can inject and execute arbitrary PHP code via the plugins array parameter in plugin.php. Although disputed, the vendor has issued a security advisory.
AssoCIateD (ACID) CMS 1.1.3 has multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code by supplying a malicious URL in the root_path parameter to menu.php, profile.php, users.php, cache_mngt.php, and gallery_functions.php.
A buffer overflow in the web console of F-Secure Anti-Virus for Microsoft Exchange 6.40 and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors. By default, connections are only allowed from the local host.
SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in add.php and lessid parameter in show.php.
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.
SQL injection vulnerability in editpost.php in CoolForum 0.8.3 beta and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.
A PHP remote file inclusion vulnerability in Redaxo versions 3.0 through 3.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.
A PHP remote file inclusion vulnerability in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via the bhconfig[bhfilepath] parameter in includes/webdav/server.php.
SQL injection vulnerability in viewmsg.asp of LocazoList Classifieds 1.05e allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
SQL injection vulnerability in LifeType 1.0.4 allows remote attackers to execute arbitrary SQL commands via the articleId parameter in the ViewArticle action.
Unspecified vulnerability in the CHM unpacker in avast! before version 4.7.844. The impact and attack vectors are unknown.
PHP remote file inclusion vulnerability in config.php in Rumble 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the configArr[pathtodir] parameter.
SQL injection vulnerability in content.php of abarcar Realty Portal 5.1.5 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, under certain Apache configurations (e.g., when FileInfo overrides are disabled in .htaccess), allows remote attackers to execute arbitrary code by uploading a file with multiple extensions. This is a variant of CVE-2006-2743.
A buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runtime Agent (TRA) before 5.4, and Hawk before 4.6.1 allows a remote attacker to cause a denial of service and potentially execute arbitrary code via the HTTP administrative interface.
Barnraiser Igloo 0.1.9 and earlier versions contain a PHP remote file inclusion vulnerability in Wiki.php. An attacker can execute arbitrary PHP code remotely by sending a crafted URL in the c_node[class_path] parameter.
Logicalware MailManager before version 2.0.10 does not remove the 0xc8 0x27 sequence (0xc8 followed by a single quote) from the data stream sent to the server. This allows remote attackers to modify data and gain administrative access when PostgreSQL is used.
Multiple buffer overflows in the vGetPost and main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to execute arbitrary code by sending a large amount of data containing "Submit" in an sslinvoice action, and have an unknown impact via a large amount of posted data.
SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1 allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when settings specify only "Search in Detailed description" and "Search also in ISBN." The vendor disputed this issue, claiming the bug does not pose a security threat.