CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unspecified vulnerabilities in the Programmatic Interface in Oracle Database Server from 8i up to 9.2.0.5 have unknown impact and attack vectors, aka Oracle Vuln# DB26.
Multiple unspecified vulnerabilities in Oracle Database Server from version 8i to 10.1.0.4.2 affect the Export, Materialized Views, and Security Service components. Their impact and attack vectors are unknown.
Multiple unspecified vulnerabilities in Oracle Database Server 10g up to version 10.1.0.4.2, affecting Change Data Capture, Data Pump Export, and Spatial components. They have unknown impact and attack vectors.
Unspecified vulnerability in the Intelligent Agent component of Oracle Database Server 9i up to version 9.0.1.5. Details regarding impact and attack vectors are unknown, and the issue is identified as Oracle Vuln# DB14.
Unspecified vulnerability in the PL/SQL component in Oracle Database Server from 9i up to 10.1.0.4. The impact and attack vectors are unknown, and the issue is identified as Oracle Vuln# DB01.
Unspecified vulnerability in the Spatial component in Oracle Database Server from 9i up to 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# DB17.
Multiple SQL injection vulnerabilities in Subdreamer 2.2.1 allow remote attackers to execute arbitrary SQL commands via the loginusername parameter or cookies in subdreamer.php, ipb2.php, phpbb2.php, vbulletin2.php, and vbulletin3.php.
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
SQL injection vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to execute arbitrary SQL commands via the signature_bbcode_uid parameter, which is not properly initialized.
phpBB 2.0.17 and earlier, when the register_long_arrays directive is disabled, allows remote attackers to modify global variables and bypass security mechanisms because PHP does not define the associated HTTP_* variables.
phpBB 2.0.17 and earlier, when register_globals is enabled and the session_start function has not been called to handle a session, allows remote attackers to bypass security checks by setting the $_SESSION and $HTTP_SESSION_VARS variables to strings instead of arrays, which causes an array_merge function call to fail.
Vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code via the signature_bbcode_uid parameter by injecting an 'e' modifier into a preg_replace statement.
eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials.
Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the channel parameter in the topics module and the topic parameter in the posting module.
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in (1) body_header.inc.php and (2) print.php.
In IBM AIX 5.2 and 5.3, the chcons (chcon) command with DEBUG MALLOC enabled contains a buffer overflow vulnerability. This could allow an attacker to execute arbitrary code by providing a long command line argument.
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a 'GLOBALS' fileupload field.
SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit parameter.
ATutor versions 1.4.1 through 1.5.1-pl1 allow remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter and either the asc or desc parameters set, likely due to an eval injection vulnerability.
SQL injection vulnerability in phpESP 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS