CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) via a malformed request with a single character to port 1111.
SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.
Plogger Beta 2 and earlier versions contain an SQL injection vulnerability in the 'id' parameter (index.php) and 'page' parameter, allowing remote attackers to execute arbitrary SQL commands.
SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the gallery_id parameter in view.php and image_id parameter in image.php.
SQL injection vulnerability in gallery.php in EncapsGallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Multiple potential SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via parameters in various scripts.
Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the id, start, and rand parameters to show.php, and the album parameter to index.php.
A vulnerability in the kernel of Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows a local user to modify kernel memory and execution flow through a thread termination routine that causes Asynchronous Procedure Call (APC) entries to free the wrong data.
The vulnerability in tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the 'a' parameter, which is executed with elevated privileges in a cryptographically signed Java Applet.
SQL injection vulnerability in BTGrup Admin WebController Script allows remote attackers to execute arbitrary SQL commands via the Username and Password fields.
LogiSphere 0.9.9j does not restrict the number of messages that can be sent, which allows remote attackers to cause a denial of service by sending a large number of messages via the msg command.
Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before version 1.0 have unknown impact and attack vectors. These are distinct from the vulnerabilities identified by CVE-2005-4199.
SQL injection vulnerability in index.php in Netref 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. The provenance of this issue is unknown; the details were obtained solely from third party sources.
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the ParentId, ResourceId, ResourceOffset, F_UserName, and F_Password parameters.
Multiple SQL injection vulnerabilities in MyBB before 1.0 allow remote attackers to execute arbitrary SQL commands via the month, day, and year parameters in an addevent action in calendar.php; threadmode and showcodebuttons in an options action in usercp.php; list parameter in an editlists action to usercp.php; rating parameter in a rate action in member.php; and rating parameter in either showthread.php or ratethread.php.
Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the 'let' parameter in authors.php and 'sid' parameter in viewstory.php.
Multiple SQL injection vulnerabilities in eFiction versions 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via the 'let' parameter in a viewlist action to titles.php and via the 'username' parameter.
In eFiction 1.1, the 'Upload new image' command in 'Manage Images' allows remote attackers to upload a file with a .php extension containing a GIF header, bypassing image validation and executing arbitrary PHP code.
A vulnerability in eFiction 1.0, 1.1, and 2.0 in unspecified environments may allow remote attackers to perform unauthorized operations by directly accessing install.php or upgrade.php. It is unclear whether this is a flaw in eFiction itself or the result of incorrect system administration, such as not removing utility scripts after use.
SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS