CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The phar_make_dirstream function in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which can lead to denial of service or other unspecified impacts via a crafted TAR archive.
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, there is an issue with handling zero-length uncompressed data, which can lead to denial of service (heap memory corruption) or other unspecified impacts.
The wp_http_validate_url function in WordPress before version 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
The CVE-2016-2221 vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before version 4.4.2 allows remote attackers to redirect users to arbitrary websites. This is exploited through a malformed URL that triggers incorrect hostname parsing.
The odbc_bindcols function in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, potentially leading to application crashes.
The gdImageScaleTwoPass function in the GD Graphics Library before version 2.2.0 and in PHP before version 5.6.12 has inconsistent memory allocation and freeing approaches. This allows remote attackers to cause a denial of service through a crafted call.
The openssl_random_pseudo_bytes function in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, making it easier for remote attackers to defeat cryptographic protection mechanisms.
The Active Directory integration component in Cisco Identity Service Engine (ISE) before version 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication Protocol (PAP) authentication request.
The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.
Eval injection vulnerability in tftp_api.rb in the TFTP module in Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.
The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Librsvg before version 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.
The _rsvg_node_poly_build_path function in librsvg before version 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
Integer overflow in the php_raw_url_encode function in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 may lead to application crashes due to a long string passed to the rawurlencode function.
The Canvas implementation in WebKit on Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
WebKit in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
WebKit in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
WebKit in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support.