CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter.
Multiple SQL injection vulnerabilities in ThWboard before version 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the year parameter in calendar.php, the user parameter array in v_profile.php, and the userid parameter in misc.php.
A direct static code injection vulnerability in SimpleBBS 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the Host header, which is written to data/topics.php.
In unspecified versions of RealNetworks RealPlayer, there is an unverified vulnerability that allows a remote attacker to execute arbitrary code. The description is very vague and contains no verifiable information, and the CVE has been assigned solely for tracking purposes.
In unspecified versions of RealNetworks RealPlayer there is an unverifiable vulnerability that may allow arbitrary code execution. The information about this issue is extremely vague and cannot be independently verified.
Unspecified security leak vulnerability in Contenido before version 4.6.4, occurring when register_globals and allow_url_fopen are enabled. It is likely a PHP remote file inclusion vulnerability.
PHP remote file inclusion vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter.
SQL injection vulnerability in index.php in phpForumPro 2.2 allows remote attackers to execute arbitrary SQL commands via the parent and day parameters.
Vulnerability in the fckeditor2rc2 addon for DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP code by uploading a file that appears to be an image but contains PHP script via the FileUpload command in connector.php.
Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with a large Movie Resource atom size or a modified Sample Description Table size in an stsd atom.
Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
An unspecified vulnerability in HP-UX versions B.11.00 through B.11.23, when IPSEC is running, allows remote attackers to have an unknown impact.
SQL injection vulnerability in view_archive.cfm in CFMagic Magic List Pro 2.5 allows remote attackers to execute arbitrary SQL commands via the ListID parameter.
Multiple SQL injection vulnerabilities in CFMagic Magic Forum Personal 2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ForumID parameter in view_forum.cfm, and (2) ForumID, (3) Thread, and (4) ThreadID parameters in view_thread.cfm.
Unspecified absolute path vulnerability in umountall in IBM AIX 5.1 through 5.3 allows local users to cause unknown impact via unknown vectors.
A heap-based buffer overflow in the StreamPredictor function of Xpdf 3.01, used in multiple products including Poppler, teTeX, KDE kpdf, pdftohtml, KOffice KWord, CUPS, and libextractor, allows remote attackers to execute arbitrary code via a crafted PDF file with an out-of-range numComps field.
Multiple SQL injection vulnerabilities in Alisveristr E-commerce allow remote attackers to bypass authentication and possibly execute arbitrary SQL commands via the username and password parameters in the user login and administrator login pages.
SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Blog System 1.2 contains SQL injection vulnerabilities in the 'cat' parameter in index.php and the 'note' parameter in blog.php, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.