CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to involve an attacker at all. If not, then this issue is not a vulnerability.
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter.
SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter in edit_report_handler.php.
SQL injection vulnerability in MXChange before version 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the CatID parameter in ViewCat.php and gallery.php, and the ItemNum parameter in ViewItem.php.
SQL injection vulnerability in type.asp in multiple DUware products including DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1 and DUdirectory Pro 3.0/3.0 SQL, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, and DUpaypal 3.1/DUpaypal Pro 3.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter.
SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.
Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.
SQL injection vulnerability in session.php in DotClear before version 1.2.3. A remote attacker can execute arbitrary SQL commands via the dc_xd parameter in a cookie.
SQL injection vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the node and art_id parameters.
SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.
SQL injection vulnerability in Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 'm' parameter in index.php.
SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter in index.php and download.php, or the ckode parameter in baca.php.
SQL injection vulnerability in okiraku.php of O-Kiraku Nikki version 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the day_id parameter.
SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter.
SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL commands via the msg parameter.
PHP file include vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to include arbitrary local files via the __f parameter.
The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values, which slows down the hash table lookups.
SQL injection vulnerability in Softbiz FAQ Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in index.php, faq_qanda.php, refer_friend.php, print_article.php, and add_comment.php.