CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in ASPBB 0.4 allow remote attackers to execute arbitrary SQL commands via the TID, FORUM_ID, and PROFILE_ID parameters.
Unspecified Cisco Catalyst Switches are vulnerable to a denial of service (DoS) attack via an IP packet with the same source and destination IPs and ports, with the SYN flag set (aka LanD attack). This attack causes a device crash.
SQL injection vulnerability in the News module in Envolution allows remote attackers to execute arbitrary SQL commands via the startrow and catid parameters.
SQL injection vulnerability in view_Results.php in DreamLevels DreamPoll 3.0 final allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unspecified vulnerability in Positive Software Corporation CP+ (cpplus) before version 2.5.5. The flaw may be related to a bug in Perl, but there is insufficient information to confirm if it is the same as CVE-2005-3962.
A vulnerability in Trend Micro ServerProtect EarthAgent for Windows Management Console 5.58 and possibly earlier versions, when running with Trend Micro Control Manager 2.5 and 3.0, and Damage Cleanup Server 1.1, allows remote attackers to cause a denial of service (CPU consumption) via a flood of crafted packets with a certain 'magic value' to port 5005, which also leads to a memory leak.
Multiple heap-based buffer overflows in Trend Micro ServerProtect Management Console 5.58 and earlier, used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, were found in isaNVWRequest.dll and relay.dll. Remote attackers can exploit these vulnerabilities by sending crafted Chunked transfer requests with wrapped length values, leading to arbitrary code execution.
The installation of Trend Micro PC-Cillin Internet Security 2005 12.00 build 1244, and probably previous versions, uses insecure default ACLs, which allows local users to cause a denial of service (disabled service) and gain system privileges by modifying or moving critical program files.
Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier, and also in version 1.7.2 and earlier for the sort_by parameter in comments.php, allow remote attackers to execute arbitrary SQL commands via the since, sort_by, items_number parameters in comments.php, the search parameter in category.php, and the image_id parameter in picture.php.
The vulnerability in Netgear RP114 (and possibly other versions and devices) allows a remote attacker to perform a SYN flood attack between a system on the internal interface and another on the external interface, temporarily stopping routing between the interfaces.
The vulnerability in the Motorola SB5100E Cable Modem allows a remote attacker to cause a denial of service (device crash) by sending an IP packet with the same source and destination IPs and ports, with the SYN flag set (aka LAND attack).
Multiple potential SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via various parameters in scripts such as advertiser.php, announcement.php, calendar.php, and others.
PHP remote file inclusion vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $_CCFG[_PKG_PATH_DBSE] variable.
SQL injection vulnerability in poll.php in Link Up Gold 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the number parameter.
The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) via a malformed request with a single character to port 1111.
SQL injection vulnerability in forum.php of PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter. This is a different vulnerability than CVE-2005-3585.
SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.
Vulnerability in Perl in Apple Mac OS X Server 10.3.9 improperly drops privileges when using the "$<" variable to set uid, allowing attackers to gain privileges.
SQL injection vulnerability in link.php of Arab Portal System 2 Beta 2 allows remote attackers to execute arbitrary SQL commands via the PHPSESSID (session ID) or REQUEST_URI (query string) parameters.
Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the id, start, and rand parameters to show.php, and the album parameter to index.php.