CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in admin.php of MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.
The __group_complete_signal function in the RCU signal handling (signal.c) in Linux kernel 2.6.16 and possibly other versions has unknown impact and attack vectors related to improper use of BUG_ON.
Multiple SQL injection vulnerabilities exist in form.php of JBook 1.4 via the nom and mail parameters. Remote attackers can execute arbitrary SQL commands.
A PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to multiple scripts in the admin folder. This can lead to full server compromise.
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. This issue also affects version 2.01.
Multiple SQL injection vulnerabilities in MvBlog before version 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
A vulnerability in Microsoft Internet Explorer 5.01 through 6 involves incorrect return of IOleClientSite information when dynamically creating an embedded object. This can cause the object to run in the wrong security context or zone, allowing remote attackers to execute arbitrary code.
A CRLF injection vulnerability in index.php of Christoph Roeder's phpMyForum 4.0 allows remote attackers to inject HTTP headers via hex-encoded CRLF sequences in the type parameter.
A vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via specially crafted HTML elements with a certain tag, leading to memory corruption.
An unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code by instantiating the Mdt2gddr.dll, Mdt2dd.dll, and Mdt2gddo.dll COM objects as ActiveX controls, leading to memory corruption.
A buffer overflow in URLMON.DLL of Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS).
In DNGuestbook 2.0, the admin.php file contains an SQL injection vulnerability. An attacker can send crafted requests via the email and id parameters, allowing arbitrary SQL commands to be executed.
SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier. Remote attackers can execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the user_name parameter in unsubscribe.php.
The vulnerability in Buy.php of Aweb Scripts Seller uses predictable cookies for authentication based on time and script number. This allows a remote attacker to bypass authentication.
A heap-based buffer overflow in zgv before version 5.8 and xzgv before version 0.8 may allow user-assisted attackers to execute arbitrary code via a crafted JPEG image with more than 3 output components, such as CMYK or YCCK color space, which causes less memory to be allocated than required.
In SPIP 1.8.3, the file spip_login.php3 contains a PHP remote file inclusion vulnerability. An attacker can exploit the url parameter to execute arbitrary PHP code from an external source.
Multiple SQL injection vulnerabilities were found in MWNewsletter 1.0.0b. An attacker can send crafted user_email or user_name parameters to subscribe.php and unsubscribe.php scripts, allowing arbitrary SQL commands to be executed.