CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow in the YGPPicFinder.DLL ActiveX control in the AOL You've Got Pictures (YGP) Picture Finder Tool, used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.
Multiple SQL injection vulnerabilities were found in PDFdirectory before version 1.0 in files util.php, userpref.php, user.php, uploadfrm.php, title.php, team.php, stats.php, page.php, org.php, member.php, index.php, group.php, and anniv.php. These allow remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username and password parameters.
BlogPHP 1.0 contains an SQL injection vulnerability in index.php when magic_quotes_gpc is disabled. An attacker can send a crafted query via the username parameter in a login action, allowing arbitrary SQL commands and authentication bypass.
An integer overflow in the IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE occurs while scanning for wireless networks. Remote attackers can exploit this by broadcasting crafted beacon or probe response frames to execute arbitrary code.
Clipcomm CPW-100E and CP-100E devices with vulnerable firmware allow remote unauthorized access via the debug service on TCP port 60023.
Multiple unspecified vulnerabilities were found in Joomla! 1.0.5 and earlier, affecting the publishing component, Contact Component, TinyMCE Compressor, and other components. The impact and attack vectors are unknown.
A buffer overflow vulnerability in Dual DHCP DNS Server 1.0 exists in the DHCP options field. Remote attackers can exploit this to cause a denial of service (application crash) and potentially execute arbitrary code.
A remote file inclusion vulnerability exists in htmltonuke.php of the htmltonuke 2.0 alpha module for PHP-Nuke. Attackers can exploit the filnavn parameter to execute arbitrary PHP code from a remote URL.
Unspecified vulnerability in the Oracle Workflow Cartridge component across multiple Oracle products, including Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2 (9.0.4.2), and E-Business Suite and Applications 11.5.10. The vulnerability has unspecified impact and attack vectors, identified as Oracle Vuln# WF01.
Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10. The flaws affect the Oracle Workflow Cartridge component and have unspecified impact and attack vectors.
Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 affecting Data Pump, Oracle Text, Streams Apply, Streams Capture, and Streams Subcomponent. One (DB05) involves SQL injection in DBMS_METADATA_UTIL, DBMS_METADATA_INT, and DBMS_METADATA packages.
Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2 (9.0.4.2) in the Reorganize Objects & Convert Tablespace component. May lead to unknown security impacts.
Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10, affecting various components such as Application Install, Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Human Resources, Oracle Marketing, Marketing Encyclopedia System, Oracle Trade Management, and Oracle Web Applications Desktop Integration. The vulnerabilities have unspecified impact and attack vectors.
Unspecified vulnerability in the Java Net component of Oracle Database Server and Application Server. May lead to unknown security impacts.
Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1. A researcher reported that TDE stores the master key without encryption, allowing local users to obtain the key via the SGA.
Unspecified vulnerability in the Advanced Queuing component of Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.2.0.6, and 10.1.0.3. Impact and attack vectors are unknown, identified as Oracle Vuln# DB01.
Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10. These flaws have unknown impact and attack vectors, identified as REP01 and REP02.
Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10, affecting the Oracle Reports Developer component. Oracle has not disputed researcher claims that REP05 and REP06 correspond to CVE-2005-2378 and CVE-2005-2371, both involving directory traversal.
Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4. A reliable independent researcher claims it is SQL injection in the DBMS_REGISTRY package in functions IS_COMPONENT, GET_COMP_OPTION, DISABLE_DDL_TRIGGERS, SCRIPT_EXISTS, COMP_PATH, GATHER_STATS, NOTHING_SCRIPT, and VALIDATE_COMPONENTS.