CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, allowing remote attackers to cause a denial of service (infinite loop) via a crafted packet.
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
The gdImageCropThreshold function in the GD Graphics Library (libgd) before version 2.2.3, as used in PHP before version 7.0.9, allows remote attackers to cause an application crash via an invalid color index.
Integer overflow in the gdImageCreate function in the GD Graphics Library before version 2.0.34RC1, used in PHP before versions 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted image dimensions.
Integer overflow in the _gd2GetHeader function in the GD Graphics Library (libgd) before version 2.2.3, as used in PHP before version 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.
Integer overflow in the fread function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.
Integer overflow in the php_escape_html_entities_ex function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call.
Integer overflow in the php_html_entities function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.
The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.
In the GD Graphics Library (libgd) before version 2.1.1, used in PHP before version 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, there is a vulnerability that allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image mishandled by the imagescale function.
A race condition in the ioctl_file_dedupe_range function in the Linux kernel through version 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, known as a 'double fetch' vulnerability.
The apparmor_setprocattr function in the Linux kernel before version 4.6.5 does not validate the buffer size, allowing local users to gain privileges by triggering an AppArmor setprocattr hook.
The Linux kernel in version 4.7-rc6 has a vulnerability that allows local users to cause a denial of service (panic) or potentially have unspecified other impact via certain IPv6 socket operations.
The IPv6 stack in the Linux kernel before version 4.3.3 mishandles options data, allowing local users to gain privileges or cause a denial of service via a crafted sendmsg system call.
The trace_writeback_dirty_page implementation in the Linux kernel before version 4.4 improperly interacts with mm/migrate.c, allowing local users to cause a denial of service through NULL pointer dereference and system crash.
netd in Android before 2016-08-05 mishandles tethering and stdio streams, allowing attackers to cause a denial of service or possibly have unspecified other impact via a crafted application.
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.