CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
Stack-based buffer overflow in ktools library 0.3 and earlier, used in products such as centericq, orpheus, motor, and groan, allows local or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.
A PHP remote file inclusion vulnerability in athena.php of Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.
Enterprise Connector 1.0.2 and earlier contain multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the messageid parameter in send.php or a delete action in messages.php.
A memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed.
SQL injection vulnerability in process.php of 1-2-3 music store allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
SQL injection vulnerability in snews.php in sNews 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id and category parameters to index.php.
A memory leak in the icmp_push_reply function in Linux kernel versions 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) by sending a large number of crafted packets that cause the ip_append_data function to fail.
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the poll and category parameters in index.php, and the ctg parameter in an archive action.
SQL injection vulnerability in invoices.php of EZ Invoice Inc 2.0 allows remote attackers to execute arbitrary SQL commands via the 'i' parameter.
Multiple SQL injection vulnerabilities in search.php in IsolSoft Support Center 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the lorder, Priority, Status, Category, searchvalue, and field parameters.
SQL injection vulnerability in kb.php in Omnistar Live 5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id and category_id parameters.
SQL injection vulnerability in faq.php of Nicecoder iDesk 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
SQL injection vulnerability in index.php in pdjk-support suite 1.1a and earlier allows remote attackers to execute arbitrary SQL commands via the rowstart, news_id, and faq_id parameters.
PHP remote file inclusion vulnerability in support/index.php of DeskLance 2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the main parameter.
SQL injection vulnerability in DeskLance 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the announce parameter.
SQL injection vulnerability in songinfo.php in Tunez 1.21 and earlier allows remote attackers to execute arbitrary SQL commands via the song_id parameter.