CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Global Hauri ViRobot 2.0 20050817 involves the filescan component not verifying the Cookie HTTP header. This allows a remote attacker to gain administrative privileges by sending an arbitrary cookie value.
SQL injection vulnerability in login.php of Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.
Unquoted Windows search path vulnerability in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier. A local user can exploit a malicious "program" file placed in the C: folder to gain elevated privileges.
A stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service or possibly execute arbitrary code via a crafted .m3u file when the player pauses or stops the file.
The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server versions 4.6.0.4, 4.6.1.1, and possibly others before 4.6.1.2 does not drop privileges before executing other programs, allowing local users to gain elevated privileges.
SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter when creating a new post.
SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter.
The common.php script in Intensive Point iUser Ecommerce contains a PHP remote file inclusion vulnerability. An attacker can exploit the uninitialized include_path variable to include arbitrary files from a remote server.
Admbook 1.2.2 and earlier contains a direct static code injection vulnerability in write.php. A remote attacker can exploit the X-Forwarded-For HTTP header to inject and execute arbitrary PHP code, which is stored in content-data.php.
Leif M. Wright's Blog 3.5 fails to verify the password when authenticating an administrator via a cookie, allowing remote attackers to bypass login by setting the 'blogAdmin' cookie. This grants unauthorized access to the admin panel.
The Uniden UIP1868P VoIP Telephone and Router has a default password of 'admin' for the web-based configuration utility. A remote attacker can exploit this to obtain sensitive information such as dialed phone numbers and potentially connect to other hosts.
SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries via the tabls parameter, potentially causing a denial of service (inaccessible database).
Multiple SQL injection vulnerabilities exist in admin.asp of WPC.easy via the uid and pwd parameters. Remote attackers can execute arbitrary SQL commands.
The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in JavaScript or VBScript, which consumes the stack, as demonstrated by resetting the 'location' variable within the loop.
Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via absolute paths in unspecified parameters and the language cookie, as demonstrated using error.log.
Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 contain SQL injection vulnerabilities in the userid variable (users.php) and sessid variable (lib-sessions.php). Remote attackers can execute arbitrary SQL commands.
Multiple unspecified vulnerabilities in ESS/Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and WorkCentre running software versions 13.027.24.015 and 14.027.24.015 allow remote attackers to bypass authentication or gain unauthorized network access via unknown attack vectors.
PHP remote file inclusion vulnerability in index.php of Tasarim Rehberi allows remote attackers to execute arbitrary PHP code via a URL in the 'sayfaadi' or 'sayfa' parameter.
SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
Multiple SQL injection vulnerabilities were found in Skate Board 0.9. Remote attackers can execute arbitrary SQL commands via the usern parameter in sendpass.php, the usern and passwd parameters in login.php and logged.php, and the sf_cookie cookie.