CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the title, url, excerpt, or blog_name parameters.
Remote file inclusion vulnerability in Beautifier/Core.php in Brad Fears phpCodeCabinet 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the BEAUT_PATH parameter.
Netious CMS 0.4 initializes session IDs based on the client IP address. A remote attacker can gain access to the administration section if originating from the same IP address as the administrator.
A PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP code by supplying a URL in the pfad parameter.
Fenestrae Faxination Server contains an unspecified vulnerability that allows remote attackers to execute arbitrary code via a crafted packet.
PHP remote file inclusion vulnerability in include/html/config.php in ModernGigabyte ModernBill 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the DIR parameter.
SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
PHP remote file inclusion vulnerability in includes/usercp_register.php in ZoneMetrics ZoneX Publishers Gold Edition 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Multiple SQL injection vulnerabilities exist in eintragen.php in GaesteChaos 0.2 and earlier. Remote attackers can execute arbitrary SQL commands via the gastname, gastwohnort, or gasteintrag parameters.
A stack-based buffer overflow in sipd.dll in AGEphone 1.24 and 1.38.1 allows remote attackers to execute arbitrary code via a crafted UDP SIP packet.
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. It is likely that 2.0.4 addresses an unspecified issue related to 'Anyone can register' functionality (user registration for guests).
A vulnerability in ColdFusion MX 7 allows attackers to bypass authentication by using programmatic access to the AdminAPI instead of the ColdFusion Administrator.
A vulnerability in the ftpd and ksu programs in MIT Kerberos 5 (up to 1.5, and 1.4.x before 1.4.4) and Heimdal (0.7.2 and earlier) fails to check return codes for setuid calls. This might allow local users to gain privileges by causing setuid to fail to drop privileges. As of 20060808, it is not known whether an exploitable attack scenario exists.
The krshd and v4rcp applications in MIT Kerberos 5 (up to 1.5 and 1.4.x before 1.4.4) on Linux and AIX, and in Heimdal 0.7.2 and earlier, do not check return codes for setuid calls. A local user can exploit this by causing setuid to fail to drop privileges (e.g., through resource exhaustion) to gain privileges.
A vulnerability in Winlogon on Microsoft Windows 2000 SP4 occurs when SafeDllSearchMode is disabled. A local user can exploit a malicious DLL placed in the UserProfile directory to elevate privileges.
Buffer overflow vulnerability in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1. It allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message. This is a different vulnerability than CVE-2006-1314.
Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability."
A buffer overflow in the DNS Client service of Microsoft Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted DNS server response. Multiple vectors exist, including a heap-based buffer overflow in a DNS server response, malformed ATMA records, and a length miscalculation in TXT, HINFO, X25, and ISDN records.
Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloading chained exception."
Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspecified vectors involving an "unchecked buffer."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS