CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In SPIP 1.8.3, the file spip_login.php3 contains a PHP remote file inclusion vulnerability. An attacker can exploit the url parameter to execute arbitrary PHP code from an external source.
A heap-based buffer overflow in zgv before version 5.8 and xzgv before version 0.8 may allow user-assisted attackers to execute arbitrary code via a crafted JPEG image with more than 3 output components, such as CMYK or YCCK color space, which causes less memory to be allocated than required.
Multiple SQL injection vulnerabilities were found in MWNewsletter 1.0.0b. An attacker can send crafted user_email or user_name parameters to subscribe.php and unsubscribe.php scripts, allowing arbitrary SQL commands to be executed.
Multiple SQL injection vulnerabilities exist in the modules.php file of APT-webshop-system versions 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT. Remote attackers can execute arbitrary SQL commands via the group, seite, and id parameters, likely in the artikel functionality. Additionally, invalid SQL queries may lead to path disclosure.
An unspecified vulnerability in the su program in HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.
SQuery 4.5 and earlier contain multiple PHP remote file inclusion vulnerabilities. An attacker can use the libpath parameter in scripts in the lib directory to execute arbitrary PHP code.
SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name field.
The vulnerability in NOD32 2.5 GUI (nod32.exe) causes it to run with SYSTEM privileges during scheduled on-demand scans, allowing local users to execute arbitrary code via unspecified attack vectors.
SQL injection vulnerability in slides.php of Crafty Syntax Image Gallery (CSIG) 3.1g and earlier allows remote authenticated users to execute arbitrary SQL commands via the limitquery_s parameter when the $projectid variable is less than 1.
SQL injection vulnerability in forum.php of Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.
The vulnerability in newimage.php in Crafty Syntax Image Gallery (CSIG) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code by sending a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.
A buffer overflow vulnerability in the xine_list_delete_current function of libxine 1.14 and earlier, distributed as xine-lib 1.1.1 and earlier, allows remote attackers to execute arbitrary code via a crafted MPEG stream.
A vulnerability in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php. The flaw exists in the frontpage option.
The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", allowing remote attackers to execute arbitrary code on a CTC workstation.
A direct static code injection vulnerability in ticker.db.php of Chucky A. Ivey N.T. 1.1.0 allows remote administrators to inject arbitrary PHP code into the config file. This code is then included by other N.T. scripts, leading to arbitrary code execution on the server.
Control cards in Cisco Optical Networking System (ONS) 15000 series nodes before April 5, 2006 are vulnerable to a DoS attack by sending an invalid response instead of the expected final ACK. The attack can cause memory exhaustion and potentially card reset.
Multiple format string vulnerabilities in the logging code of Clam AntiVirus (ClamAV) before version 0.88.1 might allow remote attackers to execute arbitrary code. However, as of April 2006, it is unclear whether this is a real vulnerability, as there is evidence that arguments are properly sanitized.
A vulnerability in OpenVPN 2.0 through 2.0.5 allows a remote malicious server to execute arbitrary code on the client by setting the LD_PRELOAD environment variable via the setenv directive.
In ESET NOD32 before version 2.51.26, the 'restore to' selection in the 'quarantine a file' capability allows restoring a file to any directory that the user has read access to. This enables local users to create new files in directories where they lack write permissions.
SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.