CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the xt_sctp module of netfilter in the Linux kernel before 2.6.17.1 allows attackers to cause a denial of service (infinite loop) by sending an SCTP chunk with a length of 0.
SQL injection vulnerability in administration/includes/login/auth.php in HotPlug CMS 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.
A remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via the ipath parameter in common.php and unspecified vectors in ad.php.
Multiple SQL injection vulnerabilities exist in Sharky e-shop 3.05 and earlier. A remote attacker can execute arbitrary SQL commands via the maingroup and secondgroup parameters in search_prod_list.asp, and the maingroup parameter in meny2.asp.
PHP remote file inclusion vulnerability in data/header.php in CMS Faethon 1.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter.
Multiple PHP remote file inclusion (RFI) vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via the lang parameter in admin.php, ecrire.php, and lire.php. The issue might be limited to a race condition during installation or improper installation, as a completed installation creates an include file that prevents external control of the $lang variable.
Content*Builder 0.7.5 contains multiple PHP remote file inclusion (RFI) vulnerabilities in various parameters (lang_path, path[cb], rel) within plugin and module files. An attacker can execute arbitrary PHP code by supplying a URL with a trailing slash, leading to application compromise.
SQL injection vulnerability in xarancms_haupt.php in xarancms 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) debut parameters in (a) read.php, and the (3) search and (4) debut parameters in (b) index.php.
Directory traversal vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to read arbitrary files via a '..' (dot dot) sequence in the uid parameter on the rss page.
PHP remote file inclusion vulnerability in Admin/rtf_parser.php in The Bible Portal Project 2.12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the destination parameter.
SQL injection vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to execute arbitrary SQL commands via the browse parameter.
Content*Builder 0.7.5 contains multiple PHP remote file inclusion vulnerabilities in libraries/comment/postComment.php, modules/poll/poll.php, modules/archive/overview.inc.php, and modules/forum/showThread.inc.php. Remote attackers can inject a URL via the path[cb], rel, or actualModuleDir parameters, leading to arbitrary PHP code execution.
Virtual War (VWar) 1.5.0 R14 and earlier contains multiple SQL injection vulnerabilities in war.php. Remote attackers can execute arbitrary SQL commands via the s, showgame, sortorder, and sortby parameters.
SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the action parameter.
A vulnerability in index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload. A remote attacker can bypass security checks and upload or execute arbitrary PHP code via the add action.
SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via the sorttype parameter to index.php.
SQL injection vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.
Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL in the DIR_LIBS parameter in action.php, media.php, xmlrpc/server.php, and xmlrpc/api_metaweblog.inc.php. This is similar to CVE-2006-2583, but the issue has been disputed by third parties who state that DIR_LIBS is defined in an include file before use.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS