CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
SQL injection vulnerability in Saphp Lesson (possibly versions 1.1 and 2.0) allows remote attackers to execute arbitrary SQL commands via the forumid parameter in showcat.php and add.php.
SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
A vulnerability in the docutils component in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.
Multiple SQL injection vulnerabilities were found in ACID 0.9.6b20 and BASE 1.2 in scripts acid_qry_main.php and base_qry_main.php. Remote attackers can execute arbitrary SQL commands via the sig[1] parameter and other parameters.
SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.
PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.
Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the SLIMP3 and AgentX dissector.
SQL injection vulnerability in chat.php of MWChat 6.8. A remote attacker can execute arbitrary SQL commands via the username parameter.
Vulnerability in Mantis before version 0.19.3 causes the User ID to be cached longer than necessary. The impact and attack vectors are unknown.
SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
The _httpsrequest function in Snoopy 1.2, used in products such as WordPress, MagpieRSS, Ampache, and Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL. The issue is due to improper handling of these characters by the fetch function.
Multiple stack-based buffer overflows in ZipGenius versions 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via a crafted ZIP archive with a long filename, a long original name in UUE/XXE/MIM files, or an ACE archive with a long filename.
Buffer overflow vulnerability in Skype for Windows versions 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via specially crafted callto:// and skype:// links or a non-standard VCARD, likely due to an error in the SysUtils.WideFmtStr Delphi routine.
Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a resultant heap-based buffer overflow.
PHP remote file inclusion vulnerability in common.php in PunBB versions 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.
PHP remote file inclusion vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
Vulnerability in Data ONTAP 7.0 and earlier allows an attacker to bypass iSCSI authentication by using a modified client that skips the Security (Start) mode required by the Login Negotiation protocol and directly enters Operational mode without proving identity.
The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.