CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in the Additional Images module for osCommerce before version 1.14. Remote attackers can execute arbitrary SQL commands via the products_id parameter in product_info.php.
Complete PHP Counter contains an SQL injection vulnerability in list.php. Remote attackers can execute arbitrary SQL commands via the c or s parameters.
In bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, a heap-based buffer overflow exists. A remote attacker can exploit this by sending invalid input sequences, leading to heap corruption and potentially causing a denial of service or arbitrary code execution.
SQL injection vulnerability in WebAdmin by RT Internet Solutions (RTIS) allows remote attackers to execute arbitrary SQL commands via the username and password fields.
Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. The vulnerability was reported by third parties and details are not fully verified.
Multiple unspecified vulnerabilities in the web utility function in Hitachi Cm2/Network Node Manager and JP1/Cm2/Network Node Manager before September 30, 2005 allow attackers to execute arbitrary commands, disable services, and exploit other vulnerabilities.
IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 contains a vulnerability that allows remote authenticated users to cause a denial of service (high CPU consumption) by abnormally terminating a connection, which prevents db2agents from being properly cleared.
Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allow remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets, as demonstrated by 'OpenSSL ASN.1 brute forcer'.
A vulnerability in util-vserver before version 0.30.208-1 and kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
A buffer overflow vulnerability in the mod_radius module of ProFTPD before version 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and potentially execute arbitrary code by sending a long password.
A format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before version 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code by injecting format strings into the wprintw function.
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including the m parameter in auth.php, the f parameter in events.php, or the e parameter in plug.php.
A vulnerability in SAP R/3 allows remote code execution via a crafted UDP packet sent to the lnaxdm/sapsys process. Multiple SAP versions fail to properly restrict process execution.
SQL injection vulnerability in project-edit.asp of Digger Solutions Intranet Open Source (IOS) version 2.7.2. Attackers can execute arbitrary SQL commands via the project_id parameter.
SQL injection vulnerability in index.php in iSupport 1.06 allows remote attackers to execute arbitrary SQL commands via the include_file parameter.
SQL injection vulnerability in tickets.php in cSupport 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pg parameter.
A directory traversal vulnerability in eFileGo 3.01 allows remote attackers to execute arbitrary code, read arbitrary files, and upload arbitrary files via a triple dot (...) in the URL on port 608 or in the argument to upload.exe.
SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
SQL injection vulnerability in index.php of HelpDeskPoint 2.38 and earlier. Remote attackers can execute arbitrary SQL commands via the 'page' parameter.
SQL injection vulnerability in index.php of ClientExec 2.3 allows remote attackers to execute arbitrary SQL commands via the billshowid, billdetailid, fuse, and frmClientID parameters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS