CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Security component of Oracle Database server versions 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4. May lead to unknown security impacts on the database.
Unspecified vulnerability in the Query Optimizer component of Oracle Database server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5. The flaw has unknown impact and attack vectors, identified by Oracle as DB19.
SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter ($tmpCategory variable), enabling credential theft and file uploads.
An unspecified vulnerability in context.py in the Albatross web application toolkit before version 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the handling of submitted form fields.
SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the year, month, and day parameters.
The vulnerability in Check Point VPN-1 SecureClient is due to an unquoted Windows search path. A local user can place a malicious "program.exe" file in the C:\ directory, which will be executed instead of the intended Sr_GUI.exe program.
Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the 'month' parameter in an archives view operation and possibly certain other parameters in unspecified scripts.
SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter in pictures.php.
The WP-Stats 2.0 plugin for WordPress contains an SQL injection vulnerability in wp-stats.php. Remote attackers can execute arbitrary SQL commands via the 'author' parameter.
In microBlog 2.0 RC-10, the index.php file contains an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via the month and year parameters.
The RBAC functionality in grsecurity before version 2.1.8 improperly handles when the admin role creates a service and then exits the shell without unauthenticating, causing the service to be restarted with the admin role still active.
The MyBB update distribution to version 1.0.2 omits or includes older versions of critical files, allowing SQL injection via attachment name in inc/functions_upload.php and possibly other attacks related to threadmode in usercp.php.
SQL injection vulnerability in the Admin Panel of Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the username or password parameters in index.asp.
Multiple unspecified vulnerabilities were found in MyBB before version 1.0.2 in files admin/moderate.php, admin/themes.php, inc/functions.php, inc/functions_upload.php, printthread.php, and usercp.php. These vulnerabilities are likely related to SQL injection, with unspecified impact and attack vectors.
Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.
SQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the livestock_id parameter in showInfo.php and the tank_id parameter, possibly in livestock.php.
SQL injection vulnerability in news.asp of Mini-Nuke CMS System version 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
A format string vulnerability in the error-reporting feature of the mysqli extension in PHP 5.1.0 and 5.1.1 may allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via the 'date' parameter in cal.php, which is included by index.php.
SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.