CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the 'Appearance' dialog and selecting the 'Additional styles (skins) are available on the Lexmark web site' option, which launches a web browser running with SYSTEM privileges.
Untrusted search path vulnerability in opcontrol in OProfile 0.9.1 and earlier allows local users to execute arbitrary commands via a modified PATH pointing to malicious 'which' or 'dirname' programs. Although opcontrol is not normally setuid, common sudo usage makes this a serious issue.
phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.
Multiple SQL injection vulnerabilities in phpstatus 1.0, when gpc_magic_quotes is disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in check.php and unknown attack vectors in the administrative interface.
PluggedOut Blog 1.9.9c contains an SQL injection vulnerability in exec.php. Remote attackers can execute arbitrary SQL commands via the entryid parameter in a comment_add action.
A stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0 and earlier versions, as well as in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.
A PHP remote file inclusion vulnerability in inc/backend_settings.php of Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALS[path] parameter.
An unspecified vulnerability in the Net Listener component of Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7. The impact and attack vectors are unknown, identified as Oracle Vuln# DB11.
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it is unclear if this issue has been addressed.
Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g (and possibly earlier versions) may allow remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it cannot be conclusively proven that this issue has been addressed.
Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the email and password parameters.
SQL injection vulnerability in showflat.php in Groupee (formerly Infopop) UBB.threads 6.3 and earlier. Remote attackers can execute arbitrary SQL commands via the Number parameter.
A buffer overflow in an unspecified Oracle Client utility may allow remote attackers to execute arbitrary code or cause a denial of service. Lack of details from the Oracle advisory prevents conclusive confirmation that the issue has been addressed.
Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements as the SYS user and bypass audit logging by modifying the AUTH_ALTER_SESSION attribute during TNS authentication.
SQL injection vulnerability in the Oracle Text component of Oracle Database 10g (and possibly earlier versions) allows remote attackers to execute arbitrary SQL commands via unknown vectors. Due to lack of details from Oracle advisory, it is uncertain if the issue has been addressed.
A vulnerability in urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a specially crafted BGSOUND element with a SRC attribute containing a large number of hyphens.
An unspecified vulnerability in index.php of an application available on www.egeinternet.com allows remote attackers to execute arbitrary code by sending malicious code in the 'key' parameter. It is likely a PHP remote file inclusion vulnerability where the attack vector is a URL in the 'key' parameter.
An unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as root to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.
A buffer overflow vulnerability exists in the POP3 server of Kinesphere Corporation eXchange prior to version 5.0.060125. Remote attackers can exploit a long RCPT TO argument to execute arbitrary code.