CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The web administration interface in Mentor ADSL-FR4II router running firmware 2.00.0111 does not set a default password, which allows local users to gain access.
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in index.php or member.php, action parameter in search.php or member.php, or polloptions parameter in polls.php.
The ePing plugin 1.02 and earlier for e107 portal contains a vulnerability in doping.php that allows remote attackers to execute arbitrary code or overwrite files. The issue stems from improper filtering of the eping_count and eping_host parameters, which are susceptible to shell metacharacter injection.
SQL injection vulnerability in emailvalidate.php in PHPTB Topic Boards 2.0 allows remote attackers to execute arbitrary SQL commands via the mid parameter.
Mentor ADSL-FR4II router running firmware 2.00.0111 has an undocumented web server running on TCP port 5678, which allows local users to gain access.
Nortel Contivity VPN Client V05_01.030 does not properly drop system privileges when configuring a certificate for authentication. A local user can exploit the File Open dialog box to run a program with elevated privileges.
Eval injection vulnerability in the template engine for SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via a string containing the code within curly brackets, which are processed by the PHP eval function.
Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, and script via the csscontent parameter, which is directly inserted into the gbxfinal.css file.
SQL injection vulnerability in u2u.inc.php in XMB Forum 1.9.1 allows remote attackers to execute arbitrary SQL commands via certain values that are inserted into the $in variable.
MySQL on Windows allows authenticated users with insert privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute arbitrary code via requests for non-library files or functions in libraries not tailored for MySQL, blocking the LoadLibraryEx function.
Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the FID parameter in board.php or UID parameter in member.php.
PHP remote file inclusion vulnerability in SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via the language parameter.
SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field.
MYFAQ 1.0 contains multiple SQL injection vulnerabilities in the Theme, SousTheme, Faq, and question parameters, allowing an attacker to execute arbitrary SQL commands.
In Gaim before version 1.5.0, a buffer overflow exists in the AIM and ICQ module. A remote attacker can exploit an away message containing a large number of AIM substitution strings (e.g., %t or %n), causing an application crash and potentially arbitrary code execution.
Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), used in multiple products including Drupal, phpAdsNew, phpPgAds, and phpgroupware. Remote attackers can execute arbitrary PHP code via specially crafted nested XML tags in a PHP document that are injected into an eval function call.
Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.
A buffer overflow vulnerability in dhost.exe in iMonitor for Novell eDirectory 8.7.3 on Windows allows attackers to cause a denial of service (crash) and obtain access to files via unknown vectors.
Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.
Unknown vulnerability in HP ProLiant DL585 servers running Integrated Lights Out (ILO) firmware before 1.81 allows attackers to access server controls when the server is 'powered down.'
Vulnerability data from NVD (NIST) · CISA KEV · EPSS