CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP remote file inclusion vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $_CCFG[_PKG_PATH_DBSE] variable.
The vulnerability in the Motorola SB5100E Cable Modem allows a remote attacker to cause a denial of service (device crash) by sending an IP packet with the same source and destination IPs and ports, with the SYN flag set (aka LAND attack).
The vulnerability in Netgear RP114 (and possibly other versions and devices) allows a remote attacker to perform a SYN flood attack between a system on the internal interface and another on the external interface, temporarily stopping routing between the interfaces.
Multiple potential SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via various parameters in scripts such as advertiser.php, announcement.php, calendar.php, and others.
Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier, and also in version 1.7.2 and earlier for the sort_by parameter in comments.php, allow remote attackers to execute arbitrary SQL commands via the since, sort_by, items_number parameters in comments.php, the search parameter in category.php, and the image_id parameter in picture.php.
SQL injection vulnerability in poll.php in Link Up Gold 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the number parameter.
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
SQL injection vulnerability in gallery.php in EncapsGallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the id, start, and rand parameters to show.php, and the album parameter to index.php.
Multiple potential SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via parameters in various scripts.
Vulnerability in Perl in Apple Mac OS X Server 10.3.9 improperly drops privileges when using the "$<" variable to set uid, allowing attackers to gain privileges.
Plogger Beta 2 and earlier versions contain an SQL injection vulnerability in the 'id' parameter (index.php) and 'page' parameter, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the gallery_id parameter in view.php and image_id parameter in image.php.
SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter.
SQL injection vulnerability in advertiser_statistic.php in Ad Manager Pro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ad_number parameter.
SQL injection vulnerability in index.php in Jamit Job Board 2.4.1 and earlier via the cat parameter. The vendor disputes the issue, and CVE has not verified either claim.
phpWebThings 1.4 Patched contains multiple potential SQL injection vulnerabilities in various parameters, allowing remote attackers to execute arbitrary SQL commands. Affected parameters are in download.php, forum.php, forum_edit.php, forum_write.php, guestbook.php, index.php, and myaccount.php.
myBloggie 2.1.3 beta contains multiple potential SQL injection vulnerabilities in various parameters, which may allow attackers to execute arbitrary SQL commands.
Multiple potential SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via parameters in signup.php, subcontent.php, upload.php, and usersettings.php.
SQL injection vulnerability in link.php of Arab Portal System 2 Beta 2 allows remote attackers to execute arbitrary SQL commands via the PHPSESSID (session ID) or REQUEST_URI (query string) parameters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS