CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php of CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.
SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the parent, root, and topic_id parameters to post.php3.
SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.
The vulnerability in sudo 1.6.8 and other versions is due to not clearing the PYTHONINSPECT environment variable, allowing limited local users to escalate privileges via a Python script. This is a variant of CVE-2005-4158.
The vulnerability in the go-pear.php script of PHP PEAR 0.2.2, used in Apache2Triad, allows a remote attacker to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
The server.php test script in ADOdb for PHP before version 4.70, used in multiple products including Mantis, PostNuke, Moodle, Cacti, Xaraya, PHPOpenChat, MAXdev MD-Pro, and MediaBeez, allows remote attackers to execute arbitrary SQL commands via the sql parameter when the MySQL root password is empty.
A dynamic code evaluation vulnerability in the tests/tmssql.php test script of ADOdb for PHP before version 4.70 allows remote attackers to execute arbitrary PHP functions via the 'do' parameter. This flaw can be exploited to run functions like phpinfo, leading to full server compromise.
Multiple format string vulnerabilities were found in the auth_ldap_log_reason function in Apache auth_ldap version 1.6.0 and earlier. Remote attackers can exploit these flaws, for example via a crafted username, potentially leading to arbitrary code execution.
A vulnerability in the Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a specially crafted WMF file containing ExtCreateRegion or ExtEscape function calls with inconsistent argument lengths.
A vulnerability in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt unlimited authentication without account lockout or connection rate limiting.
Multiple SQL injection vulnerabilities were found in OnePlug Solutions OnePlug CMS. Remote attackers can execute arbitrary SQL commands via the Press_Release_ID, Service_ID, and Product_ID parameters in respective ASP files.
Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the fid parameter in index.php and pagid parameter in verpag.php, and possibly other vectors.
SQL injection vulnerability in login.php of TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (the u variable).
Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before version 6.5.5, identified as potential security issues (SPR numbers). One of them (SPR# KSPR699NBP) in the NROUTER component allows a remote attacker to cause a denial of service (high CPU consumption) via a crafted vCal meeting request sent over SMTP.
Multiple memory leaks in IBM Lotus Notes and Domino Server before version 6.5.5 allow attackers to cause a denial of service via memory exhaustion and crash. The vulnerability involves unspecified vectors during SSL handshake and the stash file.
SQL injection vulnerability in linkcategory.php of Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
A buffer overflow vulnerability exists in the IMAP service of Rockliffe MailSite prior to version 6.1.22.1. This flaw can be exploited remotely, but the exact attack vectors and impact are unknown.
SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. The source of this information is unknown, and details are obtained solely from third party information.
SQL injection vulnerability in mcl_login.asp of Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. The source of this information is unknown, and details are obtained solely from third party sources.
In Wine 20050930 and other versions, the SETABORTPROC GDI Escape function in WMF files allows arbitrary code execution. This is the same vulnerability as CVE-2005-4560 but in a different codebase.