CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL injection vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the User Name field (sUserName parameter) or Password (sPassword parameter).
SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Multiple SQL injection vulnerabilities in Fortibus CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via (1) the username or password to logon.asp, (2) WeeklyNotesDisplay.asp, or (3) the Search page.
The XMLRPC server in the Ruby library (libruby) 1.8 sets an invalid default value that prevents security protection using handlers, allowing remote attackers to execute arbitrary commands.
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the username or id parameters.
Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the ci, d, or m parameter to index.asp, or the bi parameter to blog_comment.asp.
Stack-based buffer overflow in VERITAS Backup Exec Remote Agent for Windows and Netware. An attacker can remotely execute arbitrary code by sending a specially crafted CONNECT_CLIENT_AUTH request with a long password.
The vulnerability in amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
PHP remote file inclusion vulnerability in siteframe.php for Broadpool Siteframe allows remote attackers to execute arbitrary code via a URL in the LOCAL_PATH parameter.
The vulnerability in Enterasys Vertical Horizon VH-2402S switches before firmware version 2.05.05.09 consists of a hard-coded debugging account and password, allowing a remote attacker to gain elevated privileges.
Directory traversal vulnerability in InteractivePHP FusionBB .11 Beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the language parameter.
Directory traversal vulnerability in Pico Server (pServ) 3.3 allows remote attackers to read arbitrary files and execute arbitrary commands via a /./ (slash dot slash) before each .. (dot dot) sequence in the URL, which results in an incorrect directory depth count.
SQL injection vulnerability in login.asp of Cool Cafe (Cool Café) Chat 1.2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Vulnerability in modifyUser.asp in Cool Cafe Chat 1.2.1 allows remote attackers to obtain the administrator password and email address via a modified nickname value.
Vulnerability in Symantec pcAnywhere 10.5x and 11.x before 11.5, with 'Launch with Windows' enabled, allows local users with physical access to execute arbitrary commands via the Caller Properties feature.
Multiple SQL injection vulnerabilities in ProductCart Ecommerce before version 2.7 allow remote attackers to execute arbitrary SQL commands via the idcategory parameter in viewPrd.asp, lid parameter in editCategories.asp, icd parameter in modCustomCardPaymentOpt.asp, and idccr parameter in OptionFieldsEdit.asp.
The eping_validaddr function in the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the eping_host parameter.
Multiple SQL injection vulnerabilities in socialMPN allow remote attackers to execute arbitrary SQL commands via various parameters in HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS