CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in index.php for zOOm Media Gallery 2.1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the username or password fields in logIn.asp, or the intAuctionID parameter in item.asp.
MetaCart 2.0 for Paypal contains multiple SQL injection vulnerabilities in parameters: intProdID in product.asp, intCatalogID and strSubCatalogID in productsByCategory.asp, and chkText, strText, chkPrice, intPrice, chkCat, strCat in searchAction.asp. These allow remote attackers to execute arbitrary SQL commands.
Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the intProdID parameter in product.asp or strCatalog_NAME parameter in productsByCategory.asp.
Buffer overflow vulnerability in HTTPMail component in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
A vulnerability in loader.php of Ariadne CMS 2.4 that allegedly allows remote PHP code injection by modifying the ariadne parameter to point to a URL containing malicious code. The vendor disputes this, stating that loader.php first requires the ariadne.inc file which defines the $ariadne variable, preventing modification by an attacker. CVE personnel partially verified the dispute via source code inspection of Ariadne 2.4 as of July 5, 2005.
SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter in init.inc.php or zipdownload.php.
SQL injection vulnerability in Oracle Forms 10g allows remote attackers to execute arbitrary SQL commands via the Query/Where feature.
A buffer overflow vulnerability in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, also known as the 'URL Parsing Memory Corruption Vulnerability.'
A buffer overflow vulnerability in the decode_post function in ELOG before version 2.5.7 allows remote attackers to execute arbitrary code via attachments with long file names.
Multiple SQL injection vulnerabilities in DCP-Portal 6.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the lcat, doc, or uid parameters to index.php, or (2) the mid or bid parameters to forums.php.
A vulnerability in the Linux kernel 2.6 before version 2.6.11 allows a local user to gain elevated privileges by injecting mouse or keyboard events into other user sessions. The issue is due to missing access restrictions on the N_MOUSE line discipline for a TTY.
Vulnerability in AS/400 Telnet 5250 terminal emulation clients (IBM Client Access, Bosanova, PowerTerm, Mochasoft, and others) allows malicious AS/400 servers to execute arbitrary commands on the client workstation. The attack uses a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC Command), e.g., to create a backdoor account via REXEC.
SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.
PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.
Multiple buffer overflows in Cain & Abel before version 2.67 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via (1) an IKE packet with a large ID field that is not properly handled by the PSK sniffer filter, (2) the HTTP sniffer filter, or the (3) POP3, (4) SMTP, (5) IMAP, (6) NNTP, or (7) TDS sniffer filters.
SQL injection vulnerability in NotifyLink before version 3.0 allows remote attackers to execute arbitrary SQL commands via the URL.
The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument.
Buffer overflow vulnerability in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.
A vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via text strings that are not null terminated, which triggers a null dereference.