CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in Cisco Unified CallManager (CUCM) versions 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code by sending a SIP request with a long hostname. This vulnerability is known as bug CSCsd96542.
The default configuration of the IOS HTTP server in Cisco Router Web Setup (CRWS) before version 3.3.0 build 31 does not require credentials. This allows remote attackers to access the server with arbitrary privilege levels (bug CSCsa78190).
The Sections module for PHP-Nuke contains an SQL injection vulnerability. A remote attacker can execute arbitrary SQL commands via the artid parameter in a viewarticle operation.
A vulnerability in Microsoft Excel 2000-2004 allows arbitrary code execution via a crafted .xls file with a malicious SELECTION record that causes memory corruption.
An unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a crafted .xls file with a manipulated FNGROUPCOUNT value.
A vulnerability in Microsoft Excel 2000-2004 allows arbitrary code execution via a crafted .xls file with a malformed LABEL record that triggers memory corruption.
A vulnerability in Microsoft Excel 2000-2004 allows remote code execution via a crafted .xls file with a malformed BIFF record that controls an array index used as a function pointer. This flaw is known as the "Malformed OBJECT record Vulnerability."
A vulnerability in Microsoft Office Excel 2000-2004 allows remote code execution via crafted cell comments. The flaw is due to modification of critical data offsets during the file rebuilding process.
A buffer overflow vulnerability in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a crafted .xls file with specific fields in a SELECTION record, causing memory corruption.
A buffer overflow vulnerability in Microsoft Excel 2000 through 2003 allows an attacker to execute arbitrary code via a specially crafted .xls file with a modified COLINFO record. The attack requires user interaction to open the malicious file.
CMS Mundo 1.0 build 008 (and possibly other versions) contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the news_id, searchstring, id, username parameters, and user profile fields (Name, Address, Zip, City, Country, Email).
SQL injection vulnerability in search.php in SenseSites CommonSense CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the Date parameter. The provenance of this information is unknown; details are obtained from third party information.
Format string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0.9.4 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a player nickname.
SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.
SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter.
SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter.
SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
SQL injection vulnerability in search.results.php in HiveMail 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the fields[] parameter.
Remote file inclusion (RFI) vulnerability in Plume CMS 1.0.4 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the _PX_config[manager_path] parameter to index.php, rss.php, or search.php. This is a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725.
auraCMS 1.62 by Arif Supriyanto contains multiple SQL injection vulnerabilities in the 'name' and 'pesan' parameters. These allow remote attackers to execute arbitrary SQL commands, including deleting all shoutbox messages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS