CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in NewLife Blogger before version 3.3.1 allow remote attackers to execute arbitrary SQL commands via unknown attack vectors.
The template-functions-category.php file in WordPress 1.5.1 contains an SQL injection vulnerability. A remote attacker can execute arbitrary SQL commands via the $cat_ID variable, for example by using the cat parameter in a request to index.php.
SQL injection vulnerability in login.asp of NEXTWEB (i)Site allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.
Unknown vulnerability in HP-UX trusted systems B.11.00 through B.11.23 allows remote attackers to gain unauthorized access, possibly involving remshd and/or telnet -t.
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via various parameters.
Format string vulnerability in the curses_msg function of the Ncurses interface (ec_curses.c) in Ettercap before version 0.7.3 allows remote attackers to execute arbitrary code.
Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service. Technical details are not yet available.
Buffer overflow vulnerability in the READ_TCP_STRING function in game_message_functions.cpp in the network plugin for C'Nedra 0.4.0 and earlier. A remote attacker can send a long text string, leading to arbitrary code execution.
SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers to execute arbitrary SQL commands via the memKey parameter.
SQL injection vulnerability in ad/login.asp of ZonGG 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter.
A vulnerability in Sudo 1.6.8p7 on SuSE Linux 9.3 (and possibly other Linux distributions) allows a local user to gain privileges by using sudo to call su, then entering a blank password and hitting CTRL-C. The vendor and researchers have not been able to replicate this issue, stating that Sudo catches SIGINT and returns an empty string for the password.
Buffer overflow in the Aavmker4 device driver in Avast! Antivirus 4.6 and possibly other versions allows local users to cause a denial of service (system crash) and possibly execute arbitrary code via certain signals combined with crafted input.
SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter.
SQL injection vulnerability in admin/login.asp in Active News Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.
Multiple SQL injection vulnerabilities in NPDS 5.0 allow remote attackers to execute arbitrary SQL commands via the terme parameter in glossaire.php or the query parameter in links.php.
SQL injection vulnerability in SignIn.asp of India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password parameter.
SQL injection vulnerability in login.asp of an unknown product by Online Solutions for Educators (OS4E) allows remote attackers to execute arbitrary SQL commands via the password parameter.
A format string vulnerability in PeerCast 0.1211 and earlier allows remote attackers to execute arbitrary code via format strings in the URL.
Vulnerability in setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable.
Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp.