CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows were found in the xfig import code (xfig-import.c) in Dia versions 0.87 through 0.95-pre6. An attacker can exploit a crafted xfig file with an invalid color index, number of points, or depth, potentially causing unknown impacts.
A vulnerability in Apache Struts before version 1.2.9 allows a remote attacker to bypass validation by adding the 'org.apache.struts.taglib.html.Constants.CANCEL' parameter to a request. This cancels the action but is not detected by applications that do not use the isCancelled check.
A vulnerability in Apache Struts before version 1.2.9 with BeanUtils 1.7 allows a remote attacker to cause a denial of service (DoS) by submitting a multipart/form-data encoded form with a parameter name referencing the public getMultipartRequestHandler method. This provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter.
Multiple SQL injection vulnerabilities in PhxContacts 0.93.1 beta and earlier allow remote attackers to execute arbitrary SQL commands via the motclef, nbr_line_view, and id_contact parameters. This can lead to unauthorized database access.
Multiple SQL injection vulnerabilities in Null news allow remote attackers to execute arbitrary SQL commands via the user_email and user_username parameters in lostpass.php, sub.php, and unsub.php scripts.
A direct static code injection vulnerability in VNews 1.2 allows remote authenticated administrators to inject PHP code into the admin/config.php file via variables stored in that file. The attacker can then execute arbitrary code on the server.
Multiple SQL injection vulnerabilities in VNews 1.2 by vscripts (Kuba Kunkiewicz) allow remote attackers to execute arbitrary SQL commands via the loginvar parameter in admin/admin.php and the news and nom parameters in news.php.
Multiple buffer overflows in the checkscores function in scores.c of tetris-bsd in bsd-games before version 2.17-r1 on Gentoo Linux allow local users with games group membership to modify tetris-bsd.scores with crafted executable content, which executes when another user launches tetris-bsd.
SQL injection vulnerability in newsletter.php of Sourceworkshop newsletter 1.0. Remote attackers can execute arbitrary SQL commands via the newsletteremail parameter.
A vulnerability in MSO.DLL of Microsoft Office 2000, XP, and 2003 allows user-assisted attackers to cause denial of service or execute arbitrary code via crafted documents. The attack exploits an invalid array index or integer overflow, leading to access violations in various Office components.
An unspecified vulnerability in the rsh tool in Sun Grid Engine 5.3 before 20060327 and N1 Grid Engine 6.0 before 20060327 allows local users to gain root privileges.
In OneOrZero 1.6.3.0, the index.php file contains an SQL injection vulnerability in the id parameter, likely in the kans action. This allows a remote attacker to execute arbitrary SQL commands.
SQL injection vulnerability in general/sendpassword.php in PHPCollab 2.4 and 2.5.rc3, and NetOffice 2.5.3-pl1 and 2.6.0b2. Remote attackers can execute arbitrary SQL commands via the loginForm parameter in the "forgotten password" option.
vCounter 1.0 contains an SQL injection vulnerability in vCounter.php. Remote attackers can execute arbitrary SQL commands by manipulating the _SERVER[REQUEST_URI] variable in the URI.
SQL injection vulnerability in index.php of Tilde CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
In the Fast Lexical Analyzer Generator (flex) before version 2.5.33, the flex.skl file does not allocate enough memory for grammars containing REJECT statements or trailing context rules. This causes flex to generate code with a buffer overflow, potentially allowing attackers to execute arbitrary code.
An Eval Injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.
Multiple SQL injection vulnerabilities in FusionZONE CouponZONE local.cfm in version 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the companyid, scat, and coid parameters.
The Genius VideoCAM NB driver does not drop privileges when saving files, allowing local users to gain privileges by opening arbitrary files via the 'Save As' dialog.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS