CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the user id, recipe id, category id, and other ID number fields.
Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via various functions in Parser.c, Dir.c, loadconfig.c, LangCfg.c, and Html.c.
AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
The vulnerability allows remote execution of PHP code by injecting an external URL into the appdir parameter in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier.
SQL injection vulnerability in Interchange before version 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.
SQL injection vulnerability in PostCalendar 4.0.0 allows remote attackers to execute arbitrary SQL commands via search queries.
The Telnet listener for Novell iChain Server before version 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote attackers to gain access.
A vulnerability in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.
A vulnerability in NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the 'autorized=admin; root=admin' value.
Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via long output from wc to shar, or unknown vectors in unshar.
Vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication by sending an HTTP request to home.asp with a trailing slash.
SQL injection vulnerability in GoSmart Message Board allows remote attackers to execute arbitrary SQL code via the QuestionNumber and Category parameters to Forum.asp or the Username and Password parameters to Login_Exec.asp.
SQL injection vulnerability in application_top.php in Zen Cart 1.1.3 before patch 2 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.
SQL injection vulnerability in bBlog 0.7.2 and 0.7.3 allows remote attackers to execute arbitrary SQL commands via the p parameter.
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.
Vulnerability in SecureCRT 4.0, 4.1, and possibly other versions allows remote attackers to execute arbitrary commands via a telnet:// URL using the /F option to specify a configuration file on a Samba share.
The vulnerability in AppServ 2.5.x and earlier versions consists of a default username and password, allowing remote attackers to gain access to the system.
WebCalendar allows remote attackers to gain privileges by modifying critical parameters to view_entry.php or upcoming.php.
The vulnerability in JRun 4.0 involves improper generation and handling of the JSESSIONID, allowing a remote attacker to perform a session fixation attack and hijack a user's HTTP session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS