CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before version 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allows local users to gain Linux shell access by using shell metacharacters in arguments to the 'show' command in the command line interface (CLI).
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.
Multiple SQL injection vulnerabilities exist in plexum.php of NicPlex Plexum X5 and earlier. Remote attackers can execute arbitrary SQL commands via the pagesize, maxrec, and startpos parameters.
SQL injection vulnerability in plexcart.pl of NicPlex PlexCart X3 and earlier. Remote attackers can execute arbitrary SQL commands via the catid parameter.
SQL injection vulnerability in member.php of Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.
PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3. An attacker can remotely execute arbitrary PHP code by providing a URL in the page parameter.
Multiple SQL injection vulnerabilities were found in myEvent 1.x. Remote attackers can manipulate the event_id and event_desc parameters to execute arbitrary SQL commands.
The config.php file in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values stored in config.php that are later executed. The provenance of this information is unknown; details are obtained solely from third party information.
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications version 11.5.10CU1. Has unknown impact and attack vectors, known as Vuln# APPS05.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server 9.2.0.7 and 10.1.0.4. An independent researcher claims the issue is SQL injection in the GEN_RID_RANGE_BY_AREA and GEN_RID_RANGE functions of the MDSYS.SDO_PRIDX package.
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.
Unspecified vulnerability in the Export component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2. Details on impact and attack vectors are unknown, and Oracle has not confirmed if this is the same issue as CVE-2006-2081.
Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications version 11.5.10 in components iProcurement, Oracle Application Object Library, Oracle Applications Technology Stack, and Oracle Order Capture. These vulnerabilities have unknown impact and attack vectors.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, and 9.2.0.7. Impact and attack vectors are unknown.
An unspecified vulnerability in Oracle Database Server 9.2.0.6 in the Advanced Replication component. The impact and attack vectors are unknown, and the vulnerability is identified as Vuln# DB02.
Unspecified vulnerability in Oracle Database Server versions 8.1.7.4 and 9.0.1.5 in the Dictionary component. Impact and attack vectors are unknown, identified as Vuln# DB04.
Unspecified vulnerability in Oracle Database Server versions 9.0.1.5 and 9.2.0.7 in the Oracle Enterprise Manager Intelligent Agent component. Impact and attack vectors are unknown.
An unspecified vulnerability in Oracle Database Server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5 in the Oracle Spatial component. Researchers claim it is SQL injection in MDSYS.SDO_LRS_TRIG_INS, potentially allowing unauthorized data access.
Multiple unspecified vulnerabilities were found in Oracle E-Business Suite and Applications 11.5.10CU2 in components: Application Install, Oracle Diagnostics Interfaces, Oracle General Ledger, and Oracle Receivables. Their impact and attack vectors are unknown.
Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9. May lead to unknown impacts and attack vectors.