CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the SQL*ReportWriter component in Oracle Application Server 9.0 up to version 9.0.2.1. Details about impact and attack vectors are unknown, identified by Oracle as Vuln# AS10.
Unspecified vulnerability in the Web Cache component of Oracle Application Server versions 1.0 through 9.0.4.2. The impact and attack vectors are unknown, identified as Oracle Vuln# AS13.
Unspecified vulnerability in the Enterprise CRM Sales component in Oracle versions 8.81 through 8.9. The impact and attack vectors are unknown, identified by Oracle as Vuln# CRM01.
Unspecified vulnerability in JDEdwards HTML Server in Oracle EnterpriseOne 8.94 OneWorld XE up to 8.95_B1, 8.94_Q1, and SP23_K1. It has unknown impact and attack vectors, identified as Oracle Vuln# JDE01.
Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications versions 11.5 through 11.5.10, affecting various components such as Application Install, Application Object Library, Applications Technology Stack, Utilities, HRMS, Mobile Application Foundation, SDP Number Portability, Oracle Service, Service Fulfillment Manage, Universal Work Queue, and Workflow Cartridge. The impact and attack vectors are unknown.
Multiple unspecified vulnerabilities in the Programmatic Interface in Oracle Database Server from 8i up to 9.2.0.5 have unknown impact and attack vectors, aka Oracle Vuln# DB26.
Multiple unspecified vulnerabilities in Oracle Database Server from version 8i to 10.1.0.4.2 affect the Export, Materialized Views, and Security Service components. Their impact and attack vectors are unknown.
Unspecified vulnerability in the Intelligent Agent component of Oracle Database Server 9i up to version 9.0.1.5. Details regarding impact and attack vectors are unknown, and the issue is identified as Oracle Vuln# DB14.
Multiple unspecified vulnerabilities in Oracle Database Server 10g up to version 10.1.0.4.2, affecting Change Data Capture, Data Pump Export, and Spatial components. They have unknown impact and attack vectors.
Unspecified vulnerability in the Database Scheduler of Oracle Database Server 10g up to version 10.1.0.3. The impact and attack vectors are unknown, and the issue is identified as Oracle Vuln# DB08.
Incomplete blacklist vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as .unk, .asa, .htr, and .aspx, which are not filtered like the .asp extension.
Multiple unspecified vulnerabilities in Oracle Database Server 9i up to 10.1.0.4.2, including Change Data Capture, Data Guard Logical Standby, Locale, Materialized Views, Objects Extension, Oracle Label Security, Security (possibly buffer overflow in sys.pbsde.init), and Workspace Manager. Impact and attack vectors are unknown.
Unspecified vulnerability in the PL/SQL component in Oracle Database Server from 9i up to 10.1.0.4. The impact and attack vectors are unknown, and the issue is identified as Oracle Vuln# DB01.
Unspecified vulnerability in the Spatial component in Oracle Database Server from 9i up to 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# DB17.
The vulnerability in admin_news.php in Archilles Newsworld up to version 1.3.0 allows attackers to bypass authentication by obtaining the password hash of another user (e.g., through another Newsworld vulnerability) and specifying it in the pwd argument.
Archilles Newsworld before version 1.5.0-rc1 stores account.nwd and session.nwd files under the web root with insufficient access control. A remote attacker can obtain sensitive information such as usernames, hashed passwords, and session IDs, and then escalate privileges.
Multiple SQL injection vulnerabilities in Subdreamer 2.2.1 allow remote attackers to execute arbitrary SQL commands via the loginusername parameter or cookies in subdreamer.php, ipb2.php, phpbb2.php, vbulletin2.php, and vbulletin3.php.
SQL injection vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to execute arbitrary SQL commands via the signature_bbcode_uid parameter, which is not properly initialized.
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
Vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code via the signature_bbcode_uid parameter by injecting an 'e' modifier into a preg_replace statement.