CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Coppermine before version 1.4.6 allows remote attackers to upload arbitrary files via a filename with multiple file extensions when Apache has mod_mime installed.
PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
A vulnerability in phpBazar 2.1.0 and earlier allows remote attackers to bypass authentication and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1 in admin/admin.php.
A PHP remote file inclusion vulnerability in config.php of phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.
SQL injection vulnerability in MyWeb Portal Office allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. The issue affects all editions: Standard, Public, Medical, Citizen, School, and Light.
Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, allowing remote attackers to gain privileges.
An unspecified vulnerability in the installation process of Sun Java System Directory Server 5.2 causes incorrect user data to be written to a file created during installation, allowing remote or local attackers to gain elevated privileges.
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
Multiple SQL injection vulnerabilities in mono AZBOARD 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the search and cate parameters in list.asp and the id and cate parameters in admin_ok.asp.
SQL injection vulnerability in the Short Url & Url Tracker Script by YourFreeWorld.com allows remote attackers to execute arbitrary SQL commands via the id parameter in login.php.
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in index.php, song.php, faq.php, list.php, gen_m3u.php, and playlist.php.
A vulnerability in the SCTP implementation in the Linux kernel before version 2.6.16.17 allows a remote attacker to cause a system crash (denial of service) and potentially execute arbitrary code by sending a packet with a chunk length inconsistent with the actual length of provided parameters.
A buffer overflow vulnerability in the SCTP implementation in the Linux kernel before version 2.6.16.17 allows a remote attacker to cause a system crash (denial of service) and potentially execute arbitrary code by sending a crafted HB-ACK chunk.
SQL injection vulnerability in default.asp of CodeAvalanche News (CANews) 1.2. Allows remote attackers to execute arbitrary SQL commands via the password field.
A CSRF vulnerability in Serendipity before version 1.0-beta3 allows remote attackers to perform unauthorized actions on behalf of a logged-in user via a crafted link or IMG tag.
A buffer overflow in iMonitor 2.4 in Novell eDirectory 8.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown attack vectors.
A buffer overflow vulnerability exists in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, and Microsoft Works Suites through 2006. This allows user-assisted attackers to execute arbitrary code via a malformed object pointer.
In Linux kernels 2.6.16 and earlier, the readv and writev functions lack the appropriate LSM (Linux Security Modules) file_permission hooks, potentially allowing bypass of intended access restrictions.
ScozNews 1.2.1 and earlier contain multiple PHP remote file inclusion vulnerabilities via the CONFIG[main_path] parameter. An attacker can execute arbitrary PHP code by providing a malicious URL in this parameter in several script files.
An integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 occurs when handling the Content-Length HTTP header. Remote attackers can exploit this to cause a denial of service (crash) and potentially execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS