CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow vulnerability in McAfee Scan Engine 4320 with DAT version prior to 4357 allows remote attackers to execute arbitrary code via crafted LHA files.
PHP remote file inclusion vulnerability in TRG News Script 3.0 allows remote attackers to execute arbitrary PHP code via the 'dir' parameter in article.php, authorall.php, comment.php, display.php, and displayall.php.
Trend Micro Control Manager 3.0 Enterprise Edition is vulnerable to a replay attack where an attacker can capture and resend encrypted username and password, allowing unauthorized privilege escalation.
PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the script_root to reference a URL on a remote web server that contains the code.
Vulnerability in ADP Elite System Max 9000 allows remote authenticated users to gain privileges by uploading a .profile that sets the ADPROOT environment variable to the root directory.
Multiple SQL injection vulnerabilities in SnailSource phpBB 2.0.x mods allow remote attackers to execute arbitrary SQL commands via the file_id parameter to dlman.php in DLMan Pro or id parameter to links.php in Linkz Pro.
A buffer overflow in the mt_do_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path.
SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the 'change user' field.
The text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
A buffer overflow vulnerability in Convert-UUlib (Convert::UUlib) before version 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.
Multiple SQL injection vulnerabilities in default.asp in StorePortal 2.63 allow remote attackers to execute arbitrary SQL commands via the language, bpic, idcategory, content, keyword, or idproduct parameter.
SQL injection vulnerability in printthread.php in UBB.Threads allows remote attackers to execute arbitrary SQL commands via the main parameter.
Multiple SQL injection vulnerabilities in OneWorldStore allow remote attackers to execute arbitrary SQL commands via the idProduct parameter to (1) owAddItem.asp or (2) owProductDetail.asp, (3) idCategory parameter to owListProduct.asp, or (4) bSpecials parameter to owListProduct.asp.
SQL injection vulnerability in the datenbank module for phpBB, present in mod.php, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Unknown vulnerability in DameWare NT Utilities 4.8 and earlier, and Mini Remote Control 4.8 and earlier, allows local users to gain additional rights.
SQL injection vulnerability in sdating.php of aeDating 3.2 allows remote attackers to execute arbitrary SQL commands via the event parameter.
Unknown vulnerability in sCssBoard 1.11 and earlier, related to an exploit on the Profile page. Details of the flaw are unknown.
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via the email, url, orderby, min, show, and ratenum parameters in various functions.
A double free vulnerability in gtk2 before version 2.2.4 allows remote attackers to cause a denial of service (crash) via a crafted BMP image.
SQL injection vulnerability in Dream4 Koobi CMS 4.2.3 allows remote attackers to execute arbitrary SQL commands via the area parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS