CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 9.2.0.7, 10.1.0.4, and 10.2.0.1. Impact and attack vectors are unknown.
Multiple unspecified vulnerabilities in the Email Server component of Oracle Collaboration Suite versions 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1. These flaws have unknown impact and attack vectors, identified as OCS01, OCS02, OCS03, and OCS04.
Unspecified vulnerability in the Oracle Spatial component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, and 9.2.0.7. Impact and attack vectors are unknown.
Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications version 11.5.10 in components iProcurement, Oracle Application Object Library, Oracle Applications Technology Stack, and Oracle Order Capture. These vulnerabilities have unknown impact and attack vectors.
Unspecified vulnerability in the Export component of Oracle Database Server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2. Details on impact and attack vectors are unknown, and Oracle has not confirmed if this is the same issue as CVE-2006-2081.
An unspecified vulnerability in Oracle Database Server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5 in the Oracle Spatial component. Researchers claim it is SQL injection in MDSYS.SDO_LRS_TRIG_INS, potentially allowing unauthorized data access.
Unspecified vulnerability in Oracle Database Server versions 9.0.1.5 and 9.2.0.7 in the Oracle Enterprise Manager Intelligent Agent component. Impact and attack vectors are unknown.
An unspecified vulnerability in Oracle Database Server 9.2.0.6 in the Advanced Replication component. The impact and attack vectors are unknown, and the vulnerability is identified as Vuln# DB02.
Unspecified vulnerability in Oracle Database Server versions 8.1.7.4 and 9.0.1.5 in the Dictionary component. Impact and attack vectors are unknown, identified as Vuln# DB04.
Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9. May lead to unknown impacts and attack vectors.
Multiple unspecified vulnerabilities were found in Oracle E-Business Suite and Applications 11.5.10CU2 in components: Application Install, Oracle Diagnostics Interfaces, Oracle General Ledger, and Oracle Receivables. Their impact and attack vectors are unknown.
The vulnerability in edit_kategorie.php in Fuju News 1.0 allows a remote attacker to bypass authentication by setting the 'authorized' cookie.
Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the position and id parameters.
SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
SQL injection vulnerability in category.php of Article Publisher Pro 1.0.1 and earlier. Remote attackers can execute arbitrary SQL commands via the cname parameter.
Remote file inclusion vulnerability in PHP Album 0.3.2.3. An attacker can exploit the data_dir parameter in language.php by supplying an FTP URL, leading to arbitrary code execution when register_globals is enabled.
SQL injection vulnerability in the Your_Account module of PHP-Nuke 7.8 allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. The provenance of this information is unknown; details are obtained solely from third party information.
A direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and earlier versions before 2.25 allows remote attackers to inject PHP code via a semicolon in the name parameter of the systemdoc action. This can lead to arbitrary command execution.
Multiple SQL injection vulnerabilities in index.php of Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the start parameter in a search action or the type parameter in a top action.
Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter. In some cases, remote file inclusion via SMB share is possible under PHP 5.