CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in the ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to bypass security controls.
Vulnerability in the announcement.pl script of Blackboard Learning and Community Portal System in Academic Suite versions 6.3.1.424, 6.2.3.23, and earlier before version 6 allows a remote attacker to gain administrator privileges by setting the context parameter to 'admin'.
Vulnerability in Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows a remote attacker to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including admin/uploadclient.jsp, apply_firmware_action.jsp, and file.jsp.
Vulnerability in HP-UX versions B.11.00, B.11.04, B.11.11, and B.11.23 allows a remote attacker to perform a 'Rose Attack' by sending small IP fragments that do not form a complete packet, resulting in a denial of service (DoS).
A vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted pageid parameter to admin/versions.html.
A vulnerability in Hitachi Groupmax Mail SMTP versions 06-50 through 06-52-/A and 07-00 through 07-20 allows a remote attacker to stop the service by sending an email message with an invalid format.
The IKEv1 implementation in Apani Networks EpiForce 1.9 and earlier with IPSec enabled allows remote attackers to cause a denial of service (crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Due to lack of details, it is unclear which of CVE-2005-3666, CVE-2005-3667, or CVE-2005-3668 applies.
SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the step, id, and pid parameters.
SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the id, store, and step parameters.
SQL injection vulnerability in pafiledb.php in PHP Arena paFileDB Extreme Edition RC 5 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid and id parameters.
SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter in forum.asp, Headforums.asp, and Subject.asp scripts.
Multiple unspecified vulnerabilities in Driverse before version 0.56b have unknown impact and attack vectors, related to (1) a 'ptrace exploit' and (2) 'some other potential security problems.'
An unspecified vulnerability in Hitachi Cosminexus Collaboration Portal, Groupmax Collaboration Portal, and Groupmax Collaboration Web Client allows a remote attacker to cause a denial of service by sending repeated invalid requests to the Schedule component.
SQL injection vulnerability in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter in index.php, which modifies the underlying $_SERVER variable.
SQL injection vulnerability in index.php of AlmondSoft Almond Personals 4.05 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the db_id parameter.
Vulnerability in index.php of ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.
SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.
SQL injection vulnerability in the search function in Plexum PLEXCART X3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly involving the s_itemname and s_orderby parameters to plexcart.pl.
SQL injection vulnerability in ezUpload Pro 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.