CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in login.php in Digital Scribe 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
The v3flt2k.sys driver in AhnLab V3Pro 2004, V3 VirusBlock 2005, and V3Net for Windows Server does not properly validate the source of DeviceIoControl commands, allowing remote attackers to gain privileges.
SQL injection vulnerability in index.php of phpoutsourcing Noah's classifieds allows remote attackers to execute arbitrary SQL commands via the rollid parameter.
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes.
Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the tid, uid, and fid parameters in various scripts.
SQL injection vulnerability in aeDating Script 4.0 and earlier. An attacker can inject arbitrary SQL statements via the Country parameter in search_result.php.
SQL injection vulnerability in password_reminder.php in ATutor before version 1.5.1 pl1. A remote attacker can execute arbitrary SQL commands via the email field.
The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.
Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include_once statement.
Stack-based buffer overflow in AVIRA Desktop for Windows version 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to execute arbitrary code via a long filename in an ACE archive.
The vulnerability in pam_per_user before version 0.4 does not verify if the username changes between authentication attempts and uses the same subrequest handle, allowing remote or local attackers to log in as other users by using applications that allow username changes during authentication, such as /bin/login.
The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.
A buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
Buffer overflow vulnerability in apply.cgi in Linksys WRT54G routers versions 3.01.03, 3.03.6, and possibly others before 4.20.7. A remote attacker can exploit a long HTTP POST request to execute arbitrary code on the device.
The vulnerability in the ezconfig.asp file of the Linksys WRT54G router (versions 3.01.03, 3.03.6, and some configurations of 2.04.4) is due to the lack of an authentication initialization function. A remote attacker can obtain encrypted configuration information and, if the key is known, modify the configuration.
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the login field in login.php or the LocationID parameter in week.php.
A heap-based buffer overflow in NOD32 2.5 with active scanning enabled allows remote attackers to execute arbitrary code via an ARJ archive containing a file with a long filename.
SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the wn_userpw parameter in startup.php, cat, id, or stof parameters in news.php, and id parameter in print.php.
The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as demonstrated using .inc files.
phpCommunityCalendar 4.0.3 allows remote attackers to bypass authentication and gain unauthorized access via a direct request to the admin directory.