CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A PHP remote file inclusion vulnerability in Valdersoft Shopping Cart 3.0 allows attackers to execute arbitrary code via the catalogDocumentRoot parameter. This affects multiple include/templates/categories/ PHP scripts.
In PHP 4.3.10 and 4.4.x before 4.4.3 for Windows, the create_named_pipe function in libmysql.c has a stack-based buffer overflow. An attacker can exploit a long arg_host or arg_unix_socket argument, such as a long named pipe variable in the host argument to mysql_connect, to execute arbitrary code.
In Linux kernel versions 2.6.x before 2.6.11 and 2.4.x before 2.4.29, the wan/sdla.c function does not require the CAP_SYS_RAWIO privilege for SDLA firmware upgrades. Although further investigation suggests that exploitation requires root privileges (protected by CAP_NET_ADMIN), the lack of precise privilege distinction may pose a risk.
SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the usuario_nkads_admin or password_nkads_admin parameters.
In Lizard Cart CMS 1.04, SQL injection vulnerability exists in pages.php and detail.php via the id parameter. This allows a remote attacker to execute arbitrary SQL commands on the database.
SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.
PHP remote file inclusion vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter. This is a different vulnerability than CVE-2006-0076.
A vulnerability in the Intel Graphics Accelerator Driver (ialmnt5.sys) allows an attacker to cause a denial of service (system crash or screen resolution change) by providing a long text field, such as a long window title.
SQL injection vulnerability in auth.php of ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).
SQL injection vulnerability in profile.php of PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. The issue affects version 1.1 and earlier.
A direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field in a new message, which is written to a PHP file.
A PHP remote file inclusion vulnerability in forum.php of oaBoard 1.0 allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the inc parameter.
A buffer overflow vulnerability in the termsh utility on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. This is likely a different vulnerability than CVE-2005-0351 as it involves a distinct attack vector.
SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter in search.php and the email parameter in user.php.
SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
PHPjournaler 1.0 contains an SQL injection vulnerability in index.php. Remote attackers can execute arbitrary SQL commands via the readold parameter.
CubeCart contains a PHP remote file inclusion vulnerability in includes/orderSuccess.inc.php, allowing an attacker to execute arbitrary PHP code by supplying a crafted URL in the glob[rootDir] parameter.
A SQL injection vulnerability was found in VEGO Web Forum 1.26 and earlier in functions.php, functions_update.php, and functions_display.php. Remote attackers can execute arbitrary SQL commands via the theme_id parameter in index.php.
SQL injection vulnerability in home.php in eazyCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
SQL injection vulnerability in poll_frame.php of Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.