CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Akarru Social BookMarking Engine before version 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter in akarru.lib/users.php.
Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier. Unknown impact and attack vectors.
SQL injection vulnerability in Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
A vulnerability in config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.
A buffer overflow vulnerability exists in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier when a Unicode string is converted to a narrow string. This flaw may allow a remote attacker to cause an unknown impact.
An unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostic tests via unknown attack vectors.
In Joomla! 1.0.7 and earlier, multiple SQL injection vulnerabilities exist in the Admin functionality. They allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.
Multiple buffer overflows in LISTSERV 14.3 and 14.4 (including Lite and HPO) with the web archive interface enabled allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.
Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier are related to permissions. Their impact and attack vectors are unknown.
An eval injection vulnerability in the decode function of rpc_decoder.php in phpRPC 0.7 and earlier, used by runcms, exoops, and other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.
The c-client library in PHP before 4.4.4 and 5.x before 5.1.5 does not check safe_mode or open_basedir settings. In applications that accept user-controlled input for the mailbox argument of the imap_open function, this allows remote attackers to access an IMAP stream data structure and perform unauthorized IMAP actions.
SQL injection vulnerability in forumlib.php in Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
JFacets before version 0.2 allows remote attackers to gain privileges of any account by sending a GET request with a modified account profile ID.
Buffer overflow vulnerability in the IsComponentInstalled method of Internet Explorer 6.0 on Windows 2000 before SP4 and Windows XP before SP1. A remote attacker can execute arbitrary code via JavaScript calling this method with a long first argument.
In SMartBlog (SMBlog) 1.2, the index.php file contains a remote file inclusion vulnerability. An attacker can use the pg parameter or a query string without a parameter to include and execute arbitrary PHP code from an external source.
SQL injection vulnerability in MgrLogin.asp of Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. The details are obtained solely from third party information.
SQL injection vulnerability in poems.php of DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.
In Joomla! 1.0.7, the feedcreator.class.php (syndication component) allows a remote attacker to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.
WordPress 1.5.2 (and possibly earlier versions before 2.0) contains an SQL injection vulnerability in the User-Agent field of the HTTP header when posting a comment. A remote attacker can exploit this to execute arbitrary SQL commands on the database.
Multiple SQL injection vulnerabilities exist in sendcard.php in sendcard before version 3.3.0. Remote attackers can execute arbitrary SQL commands via unspecified parameters.