CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP remote file inclusion vulnerability in main.php of osTicket allows remote attackers to execute arbitrary PHP code via the include_dir parameter.
The BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which allows local users to gain privileges.
Claroline versions 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, contain multiple PHP remote file inclusion vulnerabilities. These flaws allow remote attackers to execute arbitrary PHP code on the server via unknown vectors.
Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the q or p parameters.
In Claroline 1.5.3 through 1.6 Release Candidate 1 and possibly Dokeos, the scripts document.php and insertMyDoc.php contain directory traversal vulnerabilities. This allows remote project administrators to upload arbitrary files.
SQL injection vulnerability in search.php in PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Unknown vulnerability in the serendipity_config_local.inc.php file in Serendipity before version 0.8. The impact details are unknown.
Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to perform administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
The media manager in Serendipity before version 0.8 allows remote attackers to upload and execute arbitrary .php or .shtml files.
Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) versions 1.x and 2.x allows remote attackers to execute arbitrary commands via unknown vectors.
Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm), and other versions including 2.x, 3.x, and 4.x, allows remote attackers to execute arbitrary code via a command with crafted parameters to a RADEXECD process.
The vulnerability in the edit_image.asp script of Uapplication Uphotogallery allows remote attackers to upload arbitrary files to the server.
SQL injection vulnerability in the notes module for phpBB, in posting_notes.php, allows remote attackers to execute arbitrary SQL commands via the p parameter (used in the $post_id variable) and other attack vectors.
Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the username or password parameters to admin_login.asp, or the searchstring and possibly ID parameters to default.asp.
Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the id parameter to admin.php or cat parameter to view.php.
Vulnerability in Serendipity before version 0.8 allows Chief users to hide plugins installed by other users.
A vulnerability in SitePanel 2.6.1 and earlier allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment to a trouble ticket.
SQL injection vulnerability in verify.asp of Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter.
A directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter.
Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.